Governance · Australia

OAIC breach figures: review AI data flows and supplier response arrangements

Published on NORMIX: 2026-11-02 · NORMIX

OAIC recorded 667 notifications in the first half of 2026. Healthcare and education led the reported sector volumes.

OAIC’s 26 October publication reports 667 notifications for January-June 2026, compared with 662 in the prior period. Healthcare recorded 149 and education 85; financial services recorded 51. These figures do not establish that AI caused the incidents.

For AI governance, NORMIX recommends tracing personal-information recipients, subprocessors, overseas destinations and retention settings. Link supplier notification terms to incident triage, response records and accountable owners. Test access restrictions and data minimisation using actual evidence.

The statistics create no new duty. Assess Privacy Act coverage, serious-harm thresholds and relevant exceptions before deciding whether notification is required. Use the evidence to improve controls and periodic reviews rather than claiming a generic compliance score.