The Office of the Australian Information Commissioner (OAIC) published its Notifiable Data Breaches statistics for January to June 2026 today. Notifications were 667, barely up from 662 in the previous six months.
The headline hides the real story
Underneath the flat total, large breaches grew. Breaches affecting 100,000 to 250,000 people doubled, from three to six. Breaches affecting 500,000 to one million people went from none to three. Reported breaches affecting more than one million individuals rose from four to 11. The OAIC notes that this last figure counts people affected globally, not only in Australia.
Malicious or criminal attacks remain the leading cause, and contact details and identity information are still among the most commonly compromised data. Health service providers lead on volume with 149 notifications.
This is our reading rather than the OAIC's: when the count is flat and the size climbs, the issue is less how often attackers get in and more what they find when they do.
Retention is a security control
Privacy Commissioner Carly Kind put it plainly: "Organisations can't lose personal information they don't hold."
Most security spending goes on keeping people out. Far less goes on shrinking what is inside. Deleting data is also already expected. Under Australian Privacy Principle 11, organisations covered by the Privacy Act must take reasonable steps to destroy or de-identify personal information once they no longer need it. If you are working towards ISO 27001, the same idea sits in Annex A control A.8.10, Information deletion.
The law is leaning the same way
The exposure draft of the Tranche 2 Privacy Act reforms points in the same direction. According to Herbert Smith Freehills Kramer's analysis, it would require entities to regularly assess their APP 11 compliance, work out what personal information they hold, and consider destroying it rather than only de-identifying it.
The draft also proposes a 72-hour window to notify the OAIC of a breach, with staged notification where the full picture isn't yet known. That is a proposal only. Current practice is to notify as soon as practicable.
Keep this in proportion: consultation closed on 18 September 2026, the Bill has not been introduced to Parliament, and no commencement dates have been set.
What to do now
- Find out what you hold. Start with identity documents and customer and staff records, including copies in email and backups.
- Set retention periods by record type. Base them on real legal and business need, not "just in case".
- Make deletion happen, and keep a record. Include backups and third-party systems.
- Test how quickly you could scope a breach. Pick a system and ask whose data is in it.
Key points
- Reported breaches are flat, but large breaches are increasing.
- Deleting personal information you no longer need is already expected under APP 11 and ISO 27001 control A.8.10, and the draft Tranche 2 reforms would reinforce it.
- The 72-hour notification window is a proposal in the exposure draft, not current law.
Sources
- OAIC, Large-scale data breaches on the rise, latest OAIC statistics reveal, 26 October 2026.
Need help applying this to your organisation? Talk to Cybervisory.