On February 22, the government’s mandatory data breach notification scheme will come into effect. The scheme requires organisations to notify the Office of the Australian Information Commissioner (OAIC) and the affected individual if the organisation experiences a data breach that compromises personal information and is likely to cause serious harm. Failing to comply with the scheme could result in heavy fines as well as the less-tangible loss of customer faith.
All businesses subject to the Privacy Act need to comply with the new scheme. This includes government organisations as well as businesses and not-for-profits with an annual turnover of more than $3 million. If these businesses can demonstrate to customers that they are working hard to protect their privacy, then customers are more likely to remain loyal and it will be easier to attract new customers.
Some organisations may already have all the right measures in place to comply with the scheme. For others, there may be weak spots in the organisation’s security approach or technologies that make a data breach more likely. Prevention is definitely better than cure in this case, so it’s important for organisations to focus their efforts on making sure they minimise the risk of a data breach through a data audit.
There are five key steps businesses should take to prepare for the mandatory data breach notification scheme:
- Confirm whether the business is subject to the scheme.
- Know what types of information the business’s systems hold.
- Put security controls in place to appropriately protect data based on its confidentiality or sensitivity.
- Put measures in place to detect potential breaches.
- Develop a response plan to effectively react if a data breach is suspected.
To help businesses prepare for the mandatory data breach notification scheme, we are offering a comprehensive privacy audit. We’d recommend that everyone checks to see how their organisation stacks up and, if need be, takes appropriate steps to plug any gaps. Such an audit will give business leaders confidence that their company is ready to comply with the new legislation.
Jason Akkari, Security consultant, Aleron
