Vikas Thakur / / 5 min readUnder the Notifiable Data Breaches scheme, a covered business has 30 calendar days to assess a suspected breach. The OAIC logged 595 notifications from July to December 2024. Here is who the scheme covers and what to do first.
Vikas Thakur / / 8 min read69% of the data breaches reported to Australia's privacy regulator in 2024 were malicious or criminal cyber attacks, not accidents. Phishing and ransomware caused most of the damage, according to the OAIC's latest Notifiable Data Breaches report. Health providers and government agencies were hit hardest.
Vikas Thakur / / 13 min readSection 16C of the Privacy Act makes your clinic accountable for what an overseas vendor does with a patient's data, and APP 8 sets the reasonable steps you must take before that disclosure happens. This guide breaks the rule into the vendor categories a clinic or dental practice actually runs and what each one needs on file to satisfy an exception.
Vikas Thakur / / 12 min readIn June 2026 the OAIC found two Australian health service providers breached the Privacy Act by running tracking pixels without valid consent. A cosmetic clinic or cosmetic dental practice runs the same pixels on the same kind of pages, so the same rules apply.
Vikas Thakur / / 9 min readFrom 10 December 2026, the OAIC requires any organisation using personal information in automated decision-making to disclose it in their privacy policy. A clinic's auto-accepting booking widget, suitability quiz, or triage chatbot can fall inside that definition.
Vikas Thakur / / 8 min readHealth service providers, the category dental practices fall under, accounted for 121 of the 595 data breaches reported to Australia's privacy regulator in the second half of 2024, 20% of the total. It was the top sector for the third straight reporting period.
