Queensland Mandatory Notification of Data Breach (MNDB) Statement, Notice or Register Entry

Completed records under the Queensland Mandatory Notification of Data Breach (MNDB) scheme in chapter 3A of the Information Privacy Act 2009 (Qld), as inserted by the Information Privacy and Other Legislation Amendment Act 2023: the s 51 statement to the Information Commissioner, the s 53 notice to affected individuals, s 52 further information, and entries in the s 72 register of eligible data breaches. The scheme has applied to Queensland government agencies since 1 July 2025 and to local government since 1 July 2026. A populated record names the agency and gives the date of the breach, the type of eligible data breach (unauthorised access, unauthorised disclosure or loss, s 47), the kinds of personal information involved, the number of individuals affected or notified, and the containment and mitigation steps. OIC guidance, the Act, published MNDB statistics and blank templates are decoys. Overlaps with au-data-breach-report, which is framed around the Commonwealth Notifiable Data Breaches scheme (Privacy Act 1988 Part IIIC); Commonwealth NDB signals are excluded from this classifier's enforce tiers.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium: "eligible data breach" and the chapter 3A section references are specific statutory terms, but OIC guidance, agency data breach policies (s 73) and training repeat them, and the Commonwealth NDB scheme uses the same "eligible data breach" phrase. Enforce tiers therefore require populated s 51/53/72 fields and exclude Commonwealth NDB signals. There is no public MNDB reference number format. 85/75 are heuristic evidence tiers, not measured accuracy; test values are synthetic.
Jurisdictions: au
Regulations: Information Privacy Act 2009 (Qld), Information Privacy and Other Legislation Amendment Act 2023 (Qld)
Frameworks: QGISCF
Data categories: privacy, security, government
Scope: narrow
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:eligible\s+data\s+breach(?:es)?|mandatory\s+notification\s+of\s+data\s+breach(?:es)?|MNDB|register\s+of\s+eligible\s+data\s+breaches|data\s+breach\s+register|Information\s+Privacy\s+Act\s+2009|(?:section|s\.?)\s?(?:51|52|53|72)\s+(?:statement|notice|notification|register)|statement\s+(?:about\s+(?:an?\s+)?eligible\s+data\s+breach\s+)?to\s+the\s+Information\s+Commissioner)\b

Corroborative evidence keywords

serious harm, mitigate, Office of the Information Commissioner, OIC, privacy complaint, section 166A, unauthorised access, unauthorised disclosure, phishing, misdirected, ransomware

Proximity: 300 characters

Should match

Statement about an eligible data breach to the Information Commissioner (IP Act s 51) Agency: Department of Harbour Services Date the data breach occurred: 14/08/2026 Type of eligible data breach: unauthorised disclosure Kinds of personal information: names, home addresses and dates of birth of licence holders Number of individuals affected: 1,240 A misdirected bulk email attached the licensing spreadsheet; recipients were asked to delete it. We assessed a likelihood of serious harm. — 85 tier - s 51 statement with agency, date, breach type, information kinds and count plus serious harm / misdirected evidence
Eligible data breach - notice to affected individuals (s 53) Date of breach: 3 September 2026 We are writing because a staff mailbox was accessed by an unknown party after a phishing email. We recommend you watch for suspicious messages. — 75 tier - s 53 notice to individuals with one populated field (date of breach)
Register of eligible data breaches - entry MNDB-2026-07 Date statement provided: 22/07/2026 Individuals notified: 86 Containment steps: shared drive permissions revoked and cached copies deleted on 20/07/2026 Actions to prevent similar breaches: quarterly access review of shared drives. — 85 tier - s 72 register entry with statement date, individuals notified and containment step plus "revoked" evidence
MNDB assessment Agency: Riverbend Regional Council A laptop holding rates hardship applications was stolen from a vehicle on 02/09/2026. — 75 tier - council MNDB assessment with one populated agency field
Eligible data breach notification to OIC Agency: Northgate Hospital and Health Service Number of individuals notified: 312 Kinds of personal information: patient names and appointment dates Ransomware encrypted the booking server; the agency took steps to contain and mitigate harm. — 85 tier - HHS notification with agency, count and information kinds plus ransomware / mitigate evidence

Should not match

An agency must, as soon as practicable after forming the belief that an eligible data breach has occurred, prepare a statement for the Information Commissioner. The statement must include the date the data breach occurred, a description of the kind of personal information involved and the number of affected individuals. For more information see oic.qld.gov.au. — OIC guidance / explainer
Statement about an eligible data breach to the Information Commissioner Agency: __________ Date the data breach occurred: __________ Type of eligible data breach: [select] Number of individuals affected: ____ — Blank s 51 statement form
51 Agency must give statement about eligible data breach to information commissioner (1) The agency must, as soon as practicable after forming the belief mentioned in section 50 prepare a statement. Information Privacy Act 2009, current as at 1 July 2026, legislation.qld.gov.au — Legislation text
Queensland agencies reported 214 eligible data breaches to the OIC in the first year of the MNDB scheme, with human error the leading cause, the Information Commissioner's report shows. — Published MNDB statistics / news
Notifiable Data Breaches statement to the Australian Information Commissioner (Privacy Act 1988, s 26WK) Entity: Pelican Retail Pty Ltd Date of breach: 12/08/2026 Number of individuals affected: 900 — Commonwealth NDB statement (covered by au-data-breach-report)
Data breach policy template (s 73): This policy sets out how the agency will respond to a suspected eligible data breach, including containment, assessment and notification steps. — Data breach policy template

Known false positives

OIC guidance, the Information Privacy Act text, agency data breach policies (s 73) and training material use the same statutory vocabulary and field names. Mitigation: Enforce tiers require populated fields and exclude oic.qld.gov.au / legislation.qld.gov.au, "an agency must", policy and guideline signals.
Commonwealth Notifiable Data Breaches (NDB) statements use "eligible data breach" too. Mitigation: OAIC, Australian Information Commissioner, Notifiable Data Breaches, Privacy Act 1988 and s 26WK/26WL signals are excluded from enforce tiers; those records belong to au-data-breach-report.
Published MNDB statistics and news. Mitigation: No populated agency/date/count fields, so these stay at 65 discovery.
A register exported as a bare table (headers in one row, values in later rows) may not place labels next to values. Mitigation: Such exports stay at 65 unless a labelled value appears; known gap.