NSW mandatory notification of data breach scheme (MNDB)

New South Wales has its own breach scheme for the state public sector, separate from the Commonwealth Notifiable Data Breaches scheme. Part 6A of the Privacy and Personal Information Protection Act 1998 (PPIP Act) created the Mandatory Notification of Data Breach (MNDB) scheme, which started on 28 November 2023. It covers NSW public sector agencies, Ministers, universities, local councils and state-owned corporations that are not covered by Commonwealth privacy law. It applies to personal information and to health information. The Information and Privacy Commission (IPC) and the NSW Privacy Commissioner run it.

What counts. An eligible data breach is unauthorised access to, or unauthorised disclosure of, personal information an agency holds that a reasonable person would conclude is likely to result in serious harm to someone the information is about. Loss of information also counts where unauthorised access or disclosure is likely to follow. Serious harm can be physical, financial, emotional, psychological or reputational, such as an abusive former partner learning an address or identity theft. The IPC's examples are ordinary: an email to the wrong person, access granted to the wrong staff member, a lost laptop or USB, a coding error that skips authentication, systems left unpatched, ransomware and phishing, and insiders using valid logins outside their duties.

The clock starts earlier than most teams think. The trigger is an officer or employee becoming aware of reasonable grounds to suspect an eligible breach, not the moment the report reaches the agency head. That person must report it to the head or their delegate. The head must immediately make all reasonable efforts to contain the breach, try to reduce the harm while assessing, and finish the assessment within 30 days. These are calendar days, and the IPC treats 30 as a maximum. If the assessment cannot reasonably be done in time, the head can approve an extension, but must tell the Privacy Commissioner in writing when the assessment began and that an extension was approved. Each further extension needs another notice. Give the reason for the delay.

Notifying. Once the head decides the breach is eligible, they must notify the Privacy Commissioner immediately using the IPC's approved online form (section 59M). Updates go in on a separate form quoting the IPC case number. Affected people must be told in writing as soon as practicable, with what happened, what the agency is doing, what they should do, and how to seek internal review or complain to the Privacy Commissioner. If the agency cannot contact people directly, it must publish a notice on its public notification register, take reasonable steps to publicise it, and keep it up for at least 12 months. The IPC links to these notices from its own register. Agencies can ask other NSW agencies for contact details needed to reach affected people.

Exemptions only affect notice to individuals. The Privacy Commissioner must still be told. The exemptions cover: breaches involving more than one agency where another agency has agreed to notify (section 59S); notice that would prejudice an investigation or court proceedings (59T); mitigation that removes the likelihood of serious harm before it happens (59U); conflict with a secrecy provision (59V); notice that would create a serious risk of harm to someone's health or safety (59W); and notice that would worsen the agency's cyber security or lead to further breaches (59X). The cyber exemption is temporary. It needs written notice to the Privacy Commissioner and a monthly review with an update to the Commissioner, and agencies must consider the IPC guideline for it.

Paperwork that must exist before the incident. Section 59ZD requires a publicly available data breach policy that sets out roles, the response team and the steps the agency will follow. Section 59ZE requires an internal register of eligible data breaches. The privacy management plan must describe how the agency complies with Part 6A and refer to the breach policy, and the IPC expects it to be reviewed every year. The IPC publishes an assessment guideline, a self-assessment tool, a maturity self-assessment, guides to writing a policy and managing breaches, and quarterly figures on notifications.

Watch your contractors and cloud providers. The scheme does not generally bind contracted service providers, but under section 59C an agency holds information it possesses or controls. Control includes a contractual right to access, use or get a copy of information a provider stores. Cloud and SaaS hosting of agency records will often meet that test, so a breach at a vendor can still be the agency's eligible breach. Contracts should require prompt breach reporting, containment and cooperation with your 30-day assessment. Cross-links: qld-mndb, ndb-clock, serious-harm-test, data-breach-response-plan, third-party-supply-chain, privacy-act-oaic.