Commencing on 22 February 2018, changes to the federal Privacy Act 1988 (Cth) make it compulsory for schools to notify specific types of data breaches (Notifiable Data Breaches or NDBs) to individuals affected by the breach, and to the regulator, the Office of the Australian Information Commissioner (OAIC). A data breach occurs where “personal information held by an agency or organisation is lost or subjected to unauthorised access, modification, disclosure, or other misuse or interference.”