Incoming legislation relating to mandatory notification for data breaches comes into effect from 22 February, 2018. Once in effect, the new regime will require agencies and organisations that are subject to the Privacy Act 1988 to notify both the Office of the Australian Information Commissioner (OAIC) and affected individuals in cases where there has been a confirmed ‘eligible data breach’ of personal information.