From the OAIC to the OPC: the Complete Breach-Reporting Checklist for Australia and Canada

Key Takeaway

• 🗺️ Cross-border incidents: a company holding Australian and Canadian customer records can owe a data breach notification in both countries from the same security incident, under different thresholds, deadlines and notice lists.
• 🇦🇺 Australia’s route: the Australian data breach notification law gives an organization 30 calendar days to assess a suspected eligible breach, and if the breach is confirmed, a statement goes to the Information Commissioner and affected individuals are notified as soon as practicable.
• 🇨🇦 Canada’s route: when a breach creates a real risk of significant harm, Canadian law requires reporting to the Privacy Commissioner and notifying affected individuals as soon as feasible, plus a written record of every breach kept for at least 24 months.
• 📋 The records duty: Canada’s record rule also covers the breaches an organization decides not to report, and each record should carry the reasons for that decision.
• 🧰 The combined checklist: the ten steps below prepare both filings from one evidence file, so the second notice is drafted from verified findings instead of investigating the incident twice.

A company with customers in Australia and Canada answers to two privacy regulators when personal information is breached, and the two laws ask different questions before any report becomes mandatory. Australia’s notifiable-data-breaches scheme counts a breach as reportable when unauthorized access, disclosure or loss is likely to result in serious harm; Canada’s federal private-sector law uses the real risk of significant harm standard. Those thresholds differ in wording and in application, and the deadlines differ as well: Australia allows 30 calendar days to assess a suspected breach and then requires notification as soon as practicable, while Canada requires reporting and individual notice as soon as feasible.

This checklist covers both processes and shows how they fit together. One security incident normally produces one set of verified findings, and the data breach notification for each country should draw on those same findings instead of repeating the investigation.

What Counts as Reportable: the Two Thresholds

Neither law requires a report for every security incident. Each threshold decides which breaches a data breach notification is owed for, and the two judgments are related but separate.

Australia’s threshold is the eligible data breach definition. Personal information must have been accessed, disclosed or lost without authorization in circumstances where a reasonable person would conclude that the access, disclosure or loss is likely to result in serious harm to any affected individual. The OAIC’s assessment guidance adds one important qualification: if the organization takes remedial action so that serious harm is no longer likely, the breach does not count as an eligible data breach, and the regulator says such action can be taken at any time, including during the assessment. Where information has been lost, the remedial action is adequate if it prevents unauthorized access to or disclosure of the information. An organization that suspects an eligible breach still has to do the work: the law requires a reasonable and expeditious assessment, completed within 30 calendar days of becoming aware of grounds to suspect the breach, and the OAIC recommends documenting how the conclusion was reached.

Canada’s federal regime applies a different test: the real risk of significant harm standard. Australia and Canada use similar, but distinct, thresholds for reporting data breaches. Incidents involving stolen account credentials or exposed identity documents could trigger notification obligations in both countries. Businesses must assess each country’s requirements separately and document their conclusions. Under the Canadian standard, significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, financial loss, identity theft and negative effects on the credit record, and the assessment weighs the sensitivity of the information involved and the probability that it will be misused, according to the OPC’s breach reporting guidance.

A short hypothetical shows the two tests on one set of facts. Consider an online retailer that stores customer records for both countries on the same systems, where an attacker exfiltrates names, home addresses and password hashes. For Australia, the retailer assesses whether affected individuals are likely to suffer serious harm, then judges whether remedial action, such as forced password resets, makes that harm no longer likely. For Canada, it weighs the sensitivity of the records and the probability of misuse, including how long the credentials were exposed and whether there is evidence of malicious intent. The example is illustrative; it applies the same facts to the two statutory tests without naming or implying any real organization or event.

Australia’s Data Breach Notification Process: Assess in 30 Days

When the assessment confirms an eligible data breach, Australia’s data breach notification process requires two things as soon as practicable: a statement goes to the Information Commissioner, and the affected individuals are notified. No rule fixes which comes first. The OAIC’s guidance puts the two duties in one sentence: notify the individuals at risk and give the statement to the Commissioner as soon as practicable. The statement itself must cover the breach, the kinds of information involved, and the steps individuals should take to protect themselves. Individuals receive the statement directly wherever that is practicable; where it is not, the guidance allows the contents to be published, for example on the organization’s website.

Thirty days is the ceiling for the assessment, not a working pace: the Act sets 30 calendar days from awareness as the outside limit, and delays leave affected individuals exposed for longer. Regulator numbers show the workload this process feeds: the OAIC finalised 1,327 notifications under the scheme in 2025-26, an 18% increase on the year before, according to its annual report.

Canada’s Data Breach Notification Process: Report as Soon as Feasible

Canada’s federal breach duties have been in force since November 1, 2018, and the OPC’s guidance states them as three obligations: report breaches of security safeguards that pose a real risk of significant harm to the commissioner, notify the affected individuals and relevant third parties about those breaches, and keep records of all breaches, whether or not they meet the reporting threshold. Canadian data breach notification timing follows one standard for both the regulator report and the individual notices: as soon as feasible after the organization determines the breach has occurred. There is no fixed number of days in the law.

The Breach of Security Safeguards Regulations add the detail that organizations most often miss: a record of every breach of security safeguards, reported or not, kept for 24 months after the day the organization determined the breach occurred. The OPC expects each record to carry, at minimum, the date or estimated date of the breach, a description of the circumstances, the nature of the information involved, and whether the breach was reported or individuals were notified. When an organization decides a breach did not meet the reporting threshold, the organization’s record should also carry a brief explanation of that decision, because the regulator can request these records to verify how the risk assessments were made and whether the obligations were met.

Each individual notice must carry prescribed content: a description of the circumstances of the breach, when it occurred, the personal information involved, the steps the organization has taken to reduce the risk, the steps affected individuals can take to protect themselves, and contact information the individual can use for further questions about the breach. Direct notice is the default; indirect notice, such as a public announcement, is permitted only in defined circumstances, where direct contact would be likely to cause further harm, would be likely to cause undue hardship, or where the organization has no contact details for the individuals.

In Australia, the remedial-action rule rewards fast containment: if action taken means serious harm is no longer likely, no eligible breach exists and nothing is notifiable, though the OAIC still recommends documenting the assessment. In Canada, Canada’s record-keeping duty applies regardless, so even a fully remediated incident produces a log entry with the reasoning attached. Teams that treat the two duties as one save work in one country and create gaps in the other.

A cross-border company drafts both notices from the same verified findings, and that is what makes the second filing fast. Each notice answers the same questions: who the organization is, what happened, when it happened, which information is involved, what has been done since, and what the recipient should do next. The facts must match across both countries’ filings; a contradiction between an Australian statement and a Canadian notice invites questions about the underlying investigation.

The Combined Checklist for a Cross-Pacific Incident

1. Open one evidence file. Record the date the organization became aware of the incident, preserve the technical findings, and let the same fact set feed both countries’ assessments.
2. Write the two threshold judgments separately. Australia: is serious harm likely, and did remedial action make that harm no longer likely? Canada: does the breach create a real risk of significant harm? Two conclusions, one shared evidence base.
3. Start Australia’s data breach notification assessment inside 30 days. The law allows 30 calendar days from awareness to complete the assessment; document the work as it proceeds and aim to finish well before the deadline.
4. Set Canada’s deadline from the same moment. Once the organization determines the breach creates a real risk of significant harm, the report and individual notices are due as soon as feasible; Canada’s data breach notification contents can be prepared while containment continues.
5. Draft both notices from one template. Both regulators want the circumstances, the kinds of information involved and protective recommendations; keep the two texts fact-identical and change only the legal references and each regulator’s required fields.
6. Notify individuals under each regime’s own standard. Australia: as soon as practicable, directly where practicable, otherwise a published statement. Canada: as soon as feasible, directly unless the regulations permit indirect notice.
7. Add the organizations that can reduce harm to Canada’s notice list. The OPC’s guidance names law enforcement, and the organization that processes payments, as the kinds of recipients that can reduce the risk of harm; Australian duties may add their own recipients.
8. Log the Canadian record entry even when no report is owed. Retention runs 24 months from the determination, and the reasons for a no-report decision belong in that log entry.
9. Check the parallel duties. Where an incident involved a ransomware payment made to settle, coverage under Australia’s ransomware payment reporting rule can apply in parallel for covered entities, on its own 72-hour reporting window.
10. Archive everything. The statements, notices, threshold judgments and register entries are what each regulator reviews when it later asks how the decisions were made.

When Other Privacy Regimes Also Apply

A company answering to two national regulators usually answers to more. European operations owe notification under GDPR’s 72-hour rule for qualifying breaches, and Philippine operations owe the National Privacy Commission’s own 72-hour reporting requirement; our EU and US response plan guide and our Philippine breach reporting guide cover both in detail. The pattern across all of these regimes is consistent: regulators expect documented awareness dates, written judgments and notices that carry protective advice. Set up one evidence file and one drafting template and every later filing reuses the same verified findings.

Australia is also rebuilding its Privacy Act: the government’s exposure draft privacy bill, released for consultation on August 31, 2026, proposes expanded breach obligations, including a 72-hour deadline for reporting eligible breaches to the OAIC and new duties to maintain response systems; our Privacy Act reform explainer tracks those changes. Canada’s federal breach duties have applied since November 1, 2018. The process described in this article is the current law in both countries, and the reform proposals, if passed, would add to it.

What the Regulator Statistics Show

The regulator’s own figures set the scale. The OAIC’s 2025-26 annual report records 5,268 privacy complaints received during the year, a 60% increase on 2024-25, and 1,327 notifications finalised under the breach scheme, an 18% increase, with 88% of finalisations completed within 60 days.

For January to June 2026, the half-yearly breakdown published by the OAIC on 26 October 2026, adds the detail behind those totals: 667 notifications received, and the share of large incidents rising sharply. Breaches affecting more than a million individuals rose to 11, up from 4 in the previous six months, and the regulator again identified malicious or criminal attacks as the leading cause, with contact and identity information, including identity documents, among the most compromised data types.

Health service providers remain the sector that files the most: 149 notifications in January to June 2026, the largest single share by any sector, according to the OAIC.

For a business planning its data breach notification work, the numbers carry one practical message: each filing is reviewed by a regulator that finalised 1,327 of them in 2025-26, and the quality of the record decides how that review goes. Keep the awareness date documented, write the two threshold judgments separately, notify each country on its own deadline, and archive every statement and determination. Those are the steps in the checklist above, and they are also the artifacts a regulator or auditor will ask to see years later.

Frequently Asked Questions

How long does a company have to assess a suspected breach in Australia?

Thirty calendar days from becoming aware of grounds to suspect an eligible breach, with all reasonable steps taken to complete the assessment inside that window. If the assessment confirms an eligible data breach, notification of the regulator and affected individuals follows as soon as practicable.

When must a Canadian company report a breach?

As soon as feasible after the organization determines that a breach of security safeguards creates a real risk of significant harm, to the Office of the Privacy Commissioner of Canada and to the affected individuals. Organizations that can reduce the risk of harm, such as payment processors or law enforcement, should also be notified where relevant.

Do you have to record breaches you decide not to report?

In Canada, yes. Every breach of security safeguards must be recorded and kept for at least 24 months, including breaches below the reporting threshold, and the organization’s record should carry a brief explanation of why it decided the risk threshold was not met.

What counts as an eligible data breach in Australia?

Unauthorized access, disclosure or loss of personal information in circumstances where a reasonable person would conclude that serious harm is likely. One exception applies: if remedial action makes serious harm no longer likely, the breach is not eligible and notification is not required.

What goes into a data breach notification package?

Both regimes expect a data breach notification to describe the circumstances of the breach, the kinds of information involved and protective steps for individuals, though each regulator prescribes its own fields. Recommended individual actions, such as password changes, identity document replacement and scam vigilance, belong in every version.

Can one breach trigger notifications in both countries?

Yes. A single incident can clear Australia’s serious harm assessment and Canada’s real-risk threshold on the same facts, and the combined checklist above prepares both filings from one evidence file so the two data breach notifications stay consistent.

If this intelligence helps you, you can add WorldNgayon as a preferred source on Google — free, one click, and it helps other Filipinos find the answers faster.

Financial Disclaimer

This article is published for general informational and educational purposes and does not constitute legal, financial or professional advice. Statutory thresholds, deadlines and regulator practices current at publication may change; verify each obligation against the legislation, the regulators’ guidance and qualified counsel before acting. WorldNgayon and its author accept no liability for losses arising from the use or misuse of this information. No compensation was received for this article unless explicitly disclosed.

@online{agron2026databreach,
  author       = {Agron, Edmon},
  title        = {{From the OAIC to the OPC: the Complete Breach-Reporting Checklist for Australia and Canada}},
  year         = {2026},
  date         = {2026-11-11},
  organization = {WorldNgayon},
  url          = {https://worldngayon.com/data-breach-notification-australia-canada/},
  urldate      = {}
}

TY  - ELEC
AU  - Agron, Edmon
TI  - From the OAIC to the OPC: the Complete Breach-Reporting Checklist for Australia and Canada
T2  - WorldNgayon
PY  - 2026
DA  - 2026/11/11/
UR  - https://worldngayon.com/data-breach-notification-australia-canada/
Y2  - 
ER  -