Lessons from a data breach

The Optus data breach is top of mind for a lot of Australians, particularly those who have had their data breached.

For business, the breach is a timely warning on the importance of understanding what data is held on your customers (and should you hold it?), how it is secured, how your systems work and the process to identify gaps and deficiencies, the appropriate actions if and when a breach occurs, and the impact on your relationship to your customer. This is not something that can be outsourced to IT but a whole of business issue.

The obligations on business

We all know that no system is 100% secure. For Optus, this is not the first time. In 2015, Optus agreed to an enforceable undertaking for breaching the Privacy Act in 2015.

A data breach happens when personal information is accessed or disclosed without authorisation or is lost. If the Privacy Act 1988 covers your business, you must notify affected individuals and the Office of the Australian Information Commissioner when a data breach involving personal information is likely to result in serious harm. The notification must be as soon as practicable but is expected to be no later than 30 days. Every day counts.

A business must take all reasonable steps to comply with its obligations to prevent data breaches occurring. These obligations are not limited to preventing cyber attacks. Malicious or criminal attacks represent 55% of all reported data breaches. But, human error is responsible for 41% and 4% through system faults. Where human error was involved, 43% was where personal information was emailed to the wrong recipient and 21% the unintended release or publication of personal information.

How to apologise

Your relationship with your client is about trust. Beyond the breach notification requirements, the other issue is the client relationship.

So, how should a business apologise? University of Chicago economist John List, Professor Benjamin Ho from Vassar College along with other academics studied this issue for Uber ride sharing – the experiment came about after John List, who was at the time Uber’s Chief Economist, had a bad ride sharing experience. The bottom line? The apology must come at a cost to be effective. That cost can be reputational, a commitment to do better in the future (the cost is the higher standard), or a monetary cost. The paper states: First, apologies are not a panacea - the efficacy of an apology and whether it may backfire depend on how the apology is made. Second, across treatments, money speaks louder than words - the best form of apology is to include a coupon for a future trip. Third, in some cases sending an apology is worse than sending nothing at all, particularly for repeated apologies and apologies that promise to do better.

Helping to protect against data breaches

Understand your Privacy Act obligations. Specific industries and businesses that hold specific types of data often have advanced requirements.
Review the personal information held on customers. Is their full date of birth a necessary part of what your business does? If you need to verify identify, do those identification documents really need to be stored once they have been validated? Or is positive confirmation enough? Is the data held securely and is access limited to only those who require access?
Ensuring systems have multifactor authentication
Improving staff awareness of not only cyber threats and how to prevent them - phishing, fraudulent messages etc, but reviewing how personal data is managed and accessed.
Understanding your systems and how they work together to prevent security gaps or ‘backdoor’ systems access.

< Older Post

Newer Post >

Loss carry back rules reintroduced

By Clarke McEwan • September 1, 2026

At the Federal Budget in May 2026, the Government announced that it would reintroduce a loss carry back tax offset for companies, providing a crucial buffer to any business facing difficult trading conditions.

Cents per km or logbook method: which is better?

By Clarke McEwan • August 30, 2026

Tax Time 2026 is in full swing, and with that comes a decision for anyone who uses their car for work purposes: is it better to claim a deduction using the logbook or cents per kilometre method? When can I claim car expenses? Broadly, tax deductions for car expenses (i.e. the costs you incur to own and operate a car) are available where you use your car for work-related trips, such as for travel between workplaces or to perform your work duties. The exception is ordinary commuting to and from work - such expenses cannot typically be claimed, as they’re considered private expenses. Cents per kilometre method The cents per kilometre method allows you to claim a fixed rate for each work-related kilometre you travel, up to a maximum of 5,000 km each year. This fixed rate per km covers all of your car expenses for a year, including decline in value, registration and insurance, maintenance, repairs and fuel costs. For the 2025-26 tax year, the rate of deduction is 88 cents per kilometre, which means this tax time, the maximum potential amount of deduction is $4,400. (And keep in mind that the rate of deduction has been increased to 91 cents per km as of 1 July 2026, meaning a total potential deduction of $4,550 in the 2026-27 tax year). One of the benefits of using the cents per kilometre method is that it’s relatively simple, as you don’t need to keep receipts for your fuel or car expenses. However, you do need to keep records to show how you’ve calculated your work-related kilometres (for example, a diary), and you also need to be able to show that you own the car you’re using for work. Logbook method If you have a lot of work-related car expenses and have the time, you might find that the logbook method gives you the best deduction. The logbook method allows you to claim the work-related portion of your actual car expenses. This means that you can claim for a percentage of the actual expenses incurred on running costs such as fuel, electricity, servicing, registration, insurance and the decline in value, provided you’ve used the car in the course of your work. However, as the potential deductions under the logbook method are higher, there are stricter record-keeping requirements to meet. This includes keeping a logbook, which allows the calculation of how much you can claim back, it must: - cover at least 12 continuous weeks and be broadly representative of your travel, - include the reason and purpose, as well as the destination of every work-related journey, - the odometer reading at the start and end of each journey, - and the total kilometres travelled on the journey, - include odometer readings for the start and end of the logbook period and the total kilometres travelled during that period. Each journey in your logbook must be made at the end of the journey or as soon as possible afterwards. If you don't have a valid logbook, then unfortunately you cannot use the logbook method to claim car expenses, although the cents per km method may be available instead. Which is better? The answer to whether you should choose the logbook or cents per km method is very dependent on your personal situation. If you have light work-related car use and don’t love keeping extensive records, the cents per km method may be better suited to your needs, while those who use their car for work frequently may receive a higher deduction under the logbook method. If you’re unsure which method is best for you, speak to a member of our team today.

Why Allied Health Practices Need an Accountant Who Actually Understands Allied Health

By Clarke McEwan • August 19, 2026

Why Allied Health Practices Need an Accountant Who Actually Understands Allied Health

Medical Practice Accounting for Practice Owners & Groups

By Clarke McEwan • August 17, 2026

Medical Practice Accounting for Practice Owners & Groups

Running a successful medical practice requires more than delivering excellent patient care.

Why Good Financial Management Matters in Medical Practices

By Clarke McEwan • August 11, 2026

Running a successful medical practice requires more than delivering excellent patient care. Strong financial management is essential for maintaining profitability, supporting growth, meeting compliance obligations, and ensuring the long-term sustainability of the practice.

Changes to Self Managed Super Fund (SMSF) borrowing rules

By Clarke McEwan • August 10, 2026

To ensure passage of the negative gearing and CGT discount changes that were announced in the May 2026 Federal Budget the Government agreed to make amendments to the SMSF borrowing rules. SMSFs are able to borrow in restricted circumstances which includes borrowing under a limited recourse borrowing arrangement (LRBA) to purchase a single acquirable asset. While there have previously been no specific legislative restrictions on the type of asset a SMSF can borrow to purchase, most commonly we see LRBAs being used to purchase property. Up until this point, this could have been any type of real property. These amendments will mean that when SMSF trustees wish to borrow to purchase a property, it must meet the business real property (BRP) definition. This BRP definition relates to usage of the property rather than zoning or what the property was originally built for. This change became law on 26 June 2026, but the Bill includes a 45 day transitional period which will finish on 10 August 2026. This transitional period may allow for arrangements that are currently being implemented on non-BRP assets to be allowable under the new rules where settlement occurs after 10 August 2026, provided the arrangement to purchase the property was entered into on or before 10 August 2026. We recommend that SMSF trustees who are currently implementing LRBA arrangements on non-BRP assets seek specialist SMSF legal advice to ensure their arrangements meet these transitional rules. While this change has been referred to in the media as a ban on super funds borrowing to purchase residential property, the use of the BRP definition makes the change slightly more complex than this. As this definition relates to usage of the property, it is possible that some residentially designed properties could meet the BRP definition (for example, a medical practice that operates from a residentially designed terrace dwelling). The BRP definition also requires that the property is wholly and exclusively used for business purposes. This could mean that some properties that may initially appear to be commercial in nature may not meet the BRP definition (for example, a mixed use residential and retail property on a single title). We recommend that SMSF trustees entering into new LRBAs seek advice from specialist legal and financial advisers to ensure the new requirements are met. Existing arrangements The updated rules allow for existing LRBAs over non-BRP assets to continue. They also allow for existing arrangements to be refinanced, subject to lender availability and approval. For any further information please contact our office.