Queensland Government to Legislate Mandatory Data Breach Notification
The Queensland government is set to enact a compulsory data breach notification system, as stated by Queensland Attorney-General Yvette D’Ath. The Information Privacy and Other Legislation Amendment Bill 2023 will introduce essential changes aimed at enhancing transparency, accountability within Queensland government agencies, and bolstering privacy safeguards for individuals.
This development comes in response to the Coaldrake Review on government accountability and culture, released in June 2022, which strongly recommended such action. In addition to mandating the reporting of data breaches, this bill will also make it obligatory for affected organisations to directly inform their customers of any data breaches. It is anticipated that this legislation will encourage organisations to bolster their data protection measures.
Attorney-General D’Ath emphasised the significance of this move, pointing out that recent high-profile data breaches have shown that the loss or unauthorised access to personal information can lead to significant harm to individuals. Establishing this scheme will ensure that there are clear and consistent requirements for notifying individuals about data breaches in Queensland government agencies, empowering individuals to take steps to mitigate the risks associated with such breaches.
Furthermore, these reforms will modernise Queensland’s privacy laws to align with the evolving landscape of technology and the ways in which personal information is collected, used, accessed, stored, and shared in the digital age.
The bill encompasses various other reforms, including more transparent access to cabinet documents, bringing Queensland more in line with the Commonwealth Privacy Act, and streamlining the right-to-information framework to reduce bureaucracy and enhance efficiency for both applicants and agencies.
What the Queensland Scheme Actually Covers, and What It Does Not
Queensland’s Mandatory Notification of Data Breach scheme sits in Chapter 3A of the Information Privacy Act 2009 (Qld) and commenced on 1 July 2026. It is worth being precise about who it captures, because this is the detail most coverage gets wrong.
The scheme applies to Queensland state government agencies. Local government is not covered by it. Neither is the private sector. If you run a Queensland business, this scheme does not create an obligation for you. Your data breach obligations still sit under the federal Notifiable Data Breaches scheme in the Privacy Act 1988, which is a separate regime with its own thresholds.
Where the Queensland scheme reaches private businesses is through the agencies you serve. An agency has 30 days to assess whether a breach is an eligible data breach, and once it forms that belief it must notify the Information Commissioner and the affected individuals as soon as practicable. If your platform holds their data, that clock is effectively running on you too. The agency cannot assess what it cannot see, so expect contracts to require rapid notification to the agency, forensic cooperation, and evidence of what was accessed.
The test is whether the breach is likely to result in serious harm, which means more probable than not. That is a judgement call made under time pressure with incomplete information, which is precisely why it should be rehearsed before it is needed rather than worked out live.
What the Queensland scheme actually covers
Queensland’s Mandatory Notification of Data Breach scheme, introduced through amendments to the Information Privacy Act 2009 (Qld), commenced on 1 July 2026 for Queensland state agencies. It sits alongside the Commonwealth Notifiable Data Breaches scheme rather than replacing it.
Two points are worth being precise about, because they are widely misreported.
It applies to Queensland government agencies, not to private business. If you run a Queensland company, your notification obligations continue to come from the Commonwealth Privacy Act and the Notifiable Data Breaches scheme, not from this one. The position for local governments has had its own commencement arrangements, so councils should confirm their current status with the Office of the Information Commissioner Queensland rather than assume.
It reaches suppliers through contracts. A Queensland department that suffers a breach involving data held by a supplier still has to notify. That obligation flows into supplier agreements, which is how a private business ends up with Queensland notification requirements in a contract even though the legislation does not bind it directly.
What this means if you supply Queensland Government
The notification scheme is the visible change, but for suppliers it sits on top of a requirement that has been in place for years. IS18:2018 requires Queensland departments to operate an information security management system aligned to ISO 27001, to meet the ASD Essential Eight, and to have the accountable officer attest annually.
Departments discharge part of that obligation by pushing requirements into their supply chain. In practice, suppliers are increasingly asked for one or more of the following:
- ISO 27001 certification, with a scope statement that actually covers the service being supplied
- An Essential Eight maturity assessment, usually targeting Maturity Level 2
- Evidence of independent security testing and what was done about the findings
- Contractual breach notification terms, now with timeframes shaped by the state scheme
If you sell to Queensland Government, the useful move is to find out which of those your contracts already require and which are coming at renewal, then sequence the work. Certification and maturity uplift both take months, and both are far cheaper when they are not being done against a tender deadline.
If you need to know whether the same thing has already happened to you, Siege Cyber runs compromise assessments. Get a Fixed-Price Quote.