← VCE Data Analytics U4O2

Privacy Amendment (Notifiable Data Breaches) Act 2017

Amends the Privacy Act so covered organisations must tell the OAIC and affected people after an eligible data breach, so people can protect themselves.

Part of: VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 117, ACARA Digital Technologies Years 9–10 — Privacy Principles and Digital Footprints — Module 53, WA Computer Science ATAR Year 11 — Data Management — Module 110, WA Computer Science ATAR Year 11 — Cyber Security — Module 159

Understanding Privacy Amendment (Notifiable Data Breaches) Act 2017 in VCE Data Analytics U4O2

What it does: Telling people quickly lets them take steps such as changing passwords or monitoring accounts, which is the purpose of the scheme. The turnover threshold shows that the scheme covers APP entities and not every business. The Act amended the Privacy Act 1988 so organisations must notify the OAIC and affected people after an eligible data breach. It is an amendment that adds the Notifiable Data Breaches scheme to the existing Privacy Act. It does not replace it. Most small businesses are exempt, but some are still covered, for example health service providers, so size is not the only factor. The scheme applies to organisations covered by the Privacy Act, which are called APP entities.

Common mistakes: The 2017 Act amends the Privacy Act 1988, not the Copyright Act. It adds the Notifiable Data Breaches scheme to the Privacy Act. After an eligible data breach, a covered organisation must notify both the OAIC and the affected individuals. Telling only the media does not meet the scheme.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Privacy Amendment (Notifiable Data Breaches) Act 2017 to a class →

This module's key terms are also in a printable crossword (Modules 115–134) and word search (Modules 115–150).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
What does the Privacy Amendment (Notifiable Data Breaches) Act 2017 require after an eligible data breach?
Keep the breach secret to protect reputationNotify affected individuals and the OAIC
Matches
Eligible breach -> notify the OAIC only
↓
Affected individuals must also be notified, not just the regulator. Both the OAIC and the people at risk of serious harm must be told.
Applying
Meanings
Term
Privacy Amendment (Notifiable Data Breaches) Act 2017
Meaning
Amends the Privacy Act so covered organisations must tell the OAIC and affected people after an eligible data breach, so people can protect themselves.
Practice
Privacy Amendment (Notifiable Data Breaches) Act 2017
Testing
Gaps
The NDB scheme amends the Act 1988.
Check Answer
Spots
1Act = Privacy Amendment 2017
2amends = Copyright Act 1968

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Snowy Owl' badge — List Slicer, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What does the Privacy Amendment (Notifiable Data Breaches) Act 2017 require after an eligible data breach?
A. Notify affected individuals and the OAIC ✓
B. Keep the breach secret to protect reputation
The Act amended the Privacy Act 1988 so organisations must notify the OAIC and affected people after an eligible data breach.
2. Which statement describes the Privacy Amendment (Notifiable Data Breaches) Act 2017?
A. It amends the Privacy Act 1988 (Cwlth) ✓
B. It replaces the Privacy Act 1988 (Cwlth)
It is an amendment that adds the Notifiable Data Breaches scheme to the existing Privacy Act. It does not replace it.
3. What is the main purpose of the Notifiable Data Breaches scheme?
A. Punish every organisation that stores personal data
B. Let affected people act to protect themselves from harm ✓
Notification lets people take steps such as changing passwords or watching their accounts so they can reduce the risk of serious harm.
4. Who must be told about an eligible data breach?
A. Only the organisation's own IT staff
B. The OAIC and the affected individuals ✓
The scheme requires notice to both the regulator (the OAIC) and the people affected. Telling only internal staff does not meet the requirement.
5. Which organisations does the scheme apply to?
A. Organisations covered by the Privacy Act, such as most with turnover over $3 million ✓
B. Every organisation and individual in Australia
The scheme applies to entities covered by the Privacy Act 1988, including Australian Government agencies and most businesses with annual turnover over $3 million. It does not cover everyone.

Match the Pairs

Privacy Amendment (Notifiable Data Breaches) Act 2017 → The law that amended the Privacy Act so covered organisations must notify the OAIC and affected people after an eligible data breach.
APP entity → A covered organisation bound by the scheme, such as a government agency or a business with annual turnover over $3 million.
Purpose of the scheme: affected people are told about a breach so they can protect themselves from harm. → notify(individuals) -> change passwords, watch accounts
Scope of the scheme: it applies to organisations already covered by the Privacy Act, such as businesses with turnover over $3 million. → IF turnover > 3000000 THEN covered_by_NDB_scheme
Eligible breach -> notify the OAIC only → Affected individuals must also be notified, not just the regulator. Both the OAIC and the people at risk of serious harm must be told.
Every business in Australia must follow the scheme, whatever its size → The scheme applies only to organisations covered by the Privacy Act (APP entities), such as agencies and businesses with turnover over $3 million. It is not every business.

Key Term

Privacy Amendment (Notifiable Data Breaches) Act 2017
Amends the Privacy Act so covered organisations must tell the OAIC and affected people after an eligible data breach, so people can protect themselves.

Fill in the Blanks

1. The NDB scheme amends the Privacy Act 1988.
Hint: Type the word that names the existing Act this law amends.
2. Notify affected people and the OAIC.
Hint: Type the acronym of the regulator that must be told about the breach.
3. Purpose: so people can protect themselves after a breach.
Hint: Type the verb for what affected people can do to guard against harm.
4. The scheme applies to APP entities covered by the Privacy Act.
Hint: Type the acronym for the type of organisation the scheme covers.
5. An eligible breach must be notified.
Hint: Type the word describing the kind of breach that triggers notification.

Spot the Error

Question 1
A Act = Privacy Amendment 2017
B amends = Copyright Act 1968
C adds = breach_notification
Line B — The 2017 Act amends the Privacy Act 1988, not the Copyright Act. It adds the Notifiable Data Breaches scheme to the Privacy Act.
Question 2
A scheme = NDB
B law = Privacy Act 1988
C purpose = protect_individuals
D notify(media only)
Line D — After an eligible data breach, a covered organisation must notify both the OAIC and the affected individuals. Telling only the media does not meet the scheme.
Question 3
A applies_to = all households
B agencies = covered
C turnover > 3000000 -> covered
Line A — The scheme applies to APP entities that the Privacy Act covers, such as government agencies and organisations over the turnover threshold. It does not apply to every household.
Question 4
A org = health_provider
B turnover = 1000000
C covered = False
Line C — Health service providers are covered by the Privacy Act even if their turnover is under $3 million, so covered should be True.
Question 5
A breach = eligible
B individuals.notify = False
C reason = self_protection
Line B — Affected individuals must be told about an eligible data breach. It should be True so they can protect themselves.

Student with a class code? Join your class →