Australia has mandatory notification of all ‘eligible data breaches’, All eligible data breaches must be notified to the OAIC (Office of Australian Information Commission) as soon as practicable after the entity:

• becomes aware of the eligible data breach;
• becomes aware of reasonable grounds to believe an eligible data breach has occurred; or
• is directed to do so by the Privacy Commissioner.

Australia has mandatory notification of all ‘eligible data breaches’, All eligible data breaches must be notified to all affected individuals as soon as practical after discovery.

Australia does not separate the responsibilities of a “controller” or “vendor/third party“ thus  both entities have responsibility for the reporting the data breach to the OAIC and all affected individuals.

The amount of the penalty by a person other than a corporation is an amount not more than $2,500,000 AUD.

              The amount of the penalty for corporation  is an amount not more than the greater of the following:

                     (a)  $50,000,000 AUD

                     (b)  if the court can determine the value of the benefit that the corporation , has obtained directly or indirectly and that is reasonably attributable to the conduct constituting the data breach—3 times the value of that benefit;

                     (c) if the court cannot determine the value of that benefit— than up to 30% of the annual revenue the corporation earned  during the breach period may be fined.