29 July 2026
4 min read
#Data & Privacy, #Corporate & Commercial Law
Published by:
The Office of the Australian Information Commissioner (OAIC) received 1,205 data breach notifications in 2025, the highest number since Australia's Notifiable Data Breaches (NDB) scheme commenced in 2018. The figures highlight an environment increasingly shaped by persistent cyber threats and AI-enabled risks.
While rising cyber threat activity is a significant factor in the high level of notifications, the volume of reporting also reflects strong awareness of notification obligations among organisations and agencies covered by the Privacy Act 1988 (Cth) (Privacy Act).
For entities that handle personal information, preparation before an incident occurs is the best way to reduce regulatory, operational and reputational risk. The OAIC’s response to the 2025 Qantas data breach and the Privacy Commissioner’s determination to take no further regulatory action on the matter demonstrates the value of having strong data governance. In practice, this means understanding data holdings, assessing foreseeable risks, implementing controls, managing vendors and having a tested incident response framework in place.
According to the OAIC's Australian Community Attitudes to Privacy Survey 2026, data breaches are now the top perceived privacy risk for Australians, with concern increasing from 74% in 2023 to 82% in 2026. How an organisation prepares for, manages and communicates during a privacy incident affects public confidence, stakeholder relationships and reputation. Entities covered by the Privacy Act should therefore treat data security as a core compliance and operational risk.
Most data breach notifications reported in 2025 were attributed to malicious or criminal activity, with cyber hacking the primary cause. This reflects a threat environment in which attackers are targeting sectors that hold large volumes of sensitive personal information. Health service providers were the most commonly affected in 2025, accounting for 19% of the total notifications, followed by financial services.
The OAIC has also highlighted the role of AI in data breaches, with the Privacy Commissioner stating that “agentic and advanced AI will only increase the cyber-security risks that businesses face, and it is critical that all organisations continuously review and enhance their security to protect against this growing threat.”
AI can provide attackers with more sophisticated tools, but it can also help organisations and agencies detect, assess and respond to incidents more quickly when used within appropriate governance frameworks.
On the risk side, AI-enabled tools can help threat actors create highly credible emails, websites, voice interactions and other communications. This makes phishing, impersonation and social engineering harder to identify. AI adoption also creates internal privacy and governance risks if employees input personal information into tools without adequately assessing where that information is stored, whether it is used for model training, who can access it or whether it is retained by a third-party provider.
On the response side, appropriately governed AI tools and data analysis can support anomaly detection, threat monitoring, faster triage, forensic analysis and the identification of compromised accounts. Used carefully, they can reduce the time between compromise, detection and containment, and assist in preventing potential data breaches.
The OAIC's recent report into the 2025 Qantas data breach illustrates the benefits of taking reasonable steps to reduce and address risks. Following preliminary inquiries, the Privacy Commissioner determined not to commence a Commissioner-initiated investigation or take other regulatory action in response to the incident.
The incident arose from a social engineering attack targeting an overseas third-party service provider and affected approximately five million Australians. Before the breach, Qantas had implemented cyclical audits of the contracted third-party service provider, mandatory training programs for staff at the contact centre, contractual controls requiring compliance with the Australian Privacy Principles and incident management frameworks.
Qantas’ incident management and reporting framework helped contain and remediate the breach. The report also recognised that Qantas’ post-incident remediation steps, including notifying affected individuals and establishing a dedicated support line, further reduced the risks.
The Privacy Commissioner’s approach reinforces the importance of preparation and preventative measures. The OAIC has published practical resources to assist, including its quick reference guide, online NDB self-assessment checklist and broader data breach preparation and response guidance.
The volume of notifications also appears to reflect a high level of awareness of the NDB scheme. The scheme has been operating since 2018, with obligations to assess incidents and notify where serious harm is likely. Increased reporting may therefore reflect stronger compliance practices, improved breach detection capabilities and more mature incident management processes.
The record number of data breach notifications in 2025 is a reminder that privacy and cyber security risks continue to evolve. The organisations and agencies best placed to respond take a proactive approach to compliance, implement reasonable controls and have incident-ready response mechanisms in place. They recognise that data breaches are a persistent feature of today’s digital world and continue to adapt to evolving cyber and AI risks.
If you have any questions about preparing for a data breach or assessing your notification obligations, or would like to discuss ways to strengthen your privacy and cyber risk controls, please contact us here.
Disclaimer
The information in this article is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information, we do not guarantee that the information in this article is accurate at the date it is received or that it will continue to be accurate in the future.
Published by:
