The Notifiable Data Breaches scheme, for a business commissioning software.

The scheme sits inside the Privacy Act and applies to the organisations the Act covers. That is every business with annual turnover above $3 million, plus, regardless of turnover, private health service providers, businesses that trade in personal information, credit providers, and a few other categories. Many businesses under $3 million are currently exempt.

Two cautions on that exemption. First, it is narrower than it sounds: a small business that provides a health service, or that holds tax file numbers, or that is related to a larger business, can be caught. Second, the government has committed to removing it as part of the next round of Privacy Act reform. A business commissioning software today should build as if it applies, because by the time the software is mature it probably will.

An eligible data breach has three parts. Personal information is lost, or accessed or disclosed without authorisation. A reasonable person would conclude that is likely to result in serious harm to any of the individuals. And the organisation has not been able to prevent that harm with remedial action.

The examples that matter for software are mundane. A database with no access rules, so one customer can read another's records. A storage bucket left public. A laptop with an unencrypted export on it. A staff member's account taken over because the login had no rate limit and they reused a password. None of these need an attacker to be clever.

If you suspect a breach, you have 30 days to assess whether it is eligible. That clock is real and has been enforced: a pathology business was fined for, among other things, taking too long to assess. If it is eligible, you notify the Office of the Australian Information Commissioner and the affected individuals, with a statement that says what happened, what information was involved, and what they should do.

In practice the hard part is the first sentence. You cannot assess what you cannot see. A system with no logging cannot tell you which records were accessed, so the honest answer to the regulator becomes all of them, and the notification goes to every customer you have.

The penalty regime was sharply increased in late 2022. For serious or repeated interferences with privacy, the maximum for a company is now the greater of $50 million, three times the benefit obtained, or 30 percent of adjusted turnover for the period. There is a lower tier of penalties and infringement notices for smaller failures.

The fine is rarely the biggest number. The cost of the response, the notification, the forensic work, and the customers who leave is what closes small companies. The regulator's public register is searchable.

These take five minutes. A developer who has done this before answers them without looking anything up.

• Where does the data live, which country, and why?
• Can one customer's login read another customer's records, and how do you know? Have you tried?
• Where are the secrets kept? Are any of them in the code that gets sent to the browser?
• If a record is accessed, is there a log that says who, when, and from where?
• When were the backups last restored, and what happened?
• Who is watching for vulnerabilities in the packages this is built on, and how often are they patched?