Notifiable Data Breaches and Your Finance Function

Most founders file the Notifiable Data Breaches scheme under “cybersecurity” and hand it to whoever manages IT. That's a mistake for the one function in the business handling the most sensitive personal information day to day: finance. Bank details, payroll records, tax file numbers, employee and customer personal information all sit inside your finance stack, and the finance sector already reports the second-highest number of data breaches nationally. What's changed in the last year isn't the scheme itself — it's how the breach actually happens. Increasingly, it isn't a hacker. It's a well-meaning team member pasting a cash flow model into ChatGPT to get a second opinion, or uploading a payroll file to an AI tool to fix a formula. This piece covers who the NDB scheme actually applies to, why AI has quietly become the biggest new exposure point in finance teams, and the practical steps that close the gap.

Why the Finance Function Is Already a Target

Under the Notifiable Data Breaches scheme, a business must notify affected individuals and the OAIC when personal information it holds is lost, accessed, or disclosed without authorisation in a way likely to cause serious harm that can't be remediated. Malicious and criminal attacks remain the largest single cause, and the average cost of a data breach to an Australian business is now well over $4 million. Founders often assume this doesn't apply to them because of size — the scheme's turnover threshold is $3 million — but there's a second, less-known trigger that catches almost everyone reading this: entities that trade in personal information or that are tax file number recipients are covered regardless of turnover. If you use a bookkeeper, accountant, or payroll provider who holds staff TFNs on your behalf, you are very likely already inside the scheme.

The New Risk Nobody's Watching: Shadow AI in Your Finance Stack

‘Shadow AI’ is the term for AI tools staff use to get work done without formal sign-off — a personal ChatGPT or Gemini account, a browser extension that summarises documents, an AI feature quietly switched on inside a SaaS tool nobody reviewed. Recent Australian research found more than one in three professionals regularly upload sensitive company data — including financials — into AI platforms with no oversight at all. In a finance team, that typically looks small and harmless: pasting a revenue forecast into an AI tool to tidy up the wording, uploading a spreadsheet of payroll figures to fix a formula, asking an AI assistant to draft a board pack from the underlying numbers. Each one moves personal or commercially sensitive information onto infrastructure the business doesn't control and often can't see. It isn't hypothetical risk, either — breaches where unmanaged AI use was a factor cost businesses roughly $670,000 more on average than breaches without it, largely because nobody can say with confidence what left the building and where it went.

What Actually Counts as a Notifiable Breach — and Where AI Makes It Murkier

The scheme's trigger is unauthorised access, disclosure, or loss of personal information likely to cause serious harm. Pasting a payroll file into an AI tool isn't automatically a breach — but it can create one. If that file contains names, tax file numbers, or bank details, and the tool's terms allow the provider to retain or train on it, the information has effectively been disclosed outside your control. Enterprise-tier tools such as Microsoft 365 Copilot, ChatGPT Enterprise, and Claude for Work are built differently: no training on your inputs, defined data residency, and an audit trail that lets you actually answer the question “what happened to this data?” Consumer free tiers were, historically, built to do the opposite. The distinction between the two is now one of the most consequential decisions a finance team makes, and very few have made it deliberately.

The December 2026 Deadline Most Founders Don't Know About

From 10 December 2026, updated Australian Privacy Principles require businesses to disclose, in their privacy policy, where automated decision-making — including AI — is used in ways that affect customers. For finance functions, this reaches further than it first sounds: AI-assisted credit checks, automated collections prioritisation, or risk-scoring on invoices or applications all fall inside scope if a customer is on the other end of the decision. Getting the NDB scheme right and ignoring this deadline still leaves you exposed — the two obligations now sit side by side, and neither one is optional.

Where This Sits at a Glance

Signs Your Finance Team Has an Unmanaged AI Gap

• Nobody can tell you which AI tools finance has actually used on client, banking, or payroll data this month

• Someone has pasted a cash flow model, forecast, or client list into a free ChatGPT or Gemini account “just to check something”

• You don't know whether your accounting software's AI features run on an enterprise tier or a consumer one

• There's no written policy on what finance staff can and can't put into an AI tool

• Nobody owns the question: “if an AI tool we use had a breach tomorrow, would we even know?”

The Quarterly AI Data-Boundary Check for Finance Teams

1. List every AI tool your finance or bookkeeping team has actually used in the last quarter — not just the officially approved ones

2. Confirm each tool sits on an enterprise or business tier with no training on your inputs

3. Check whether personal information — TFNs, bank details, employee data — has gone into a consumer-tier tool, and treat any instance as a potential incident

4. Review your privacy policy against the December 2026 APP 1.7 disclosure requirement if AI touches any customer-facing decision

5. Confirm one named person is responsible for triggering your NDB assessment process if a breach is suspected — “IT will handle it” is not a plan

For the other side of this equation, see our related post on AI in Bookkeeping: What Founders Should (and Shouldn't) Automate for where AI genuinely belongs in your finance stack and where a human still needs to stay in control.

The Bottom Line

Most finance teams have a reasonable handle on phishing and malware. Very few have a handle on where their own staff are pasting sensitive numbers into AI tools every day, usually with good intentions and zero visibility for the business. Growwth Partners helps founders build the governance layer around AI in finance — not to shut it down, but to make sure the tools doing your books are helping you, not quietly creating your next compliance problem. That's the same principle behind RyzUp, our own AI finance platform: built to enterprise data standards from the ground up, so the productivity gain doesn't come with a hidden breach risk attached.

Not Sure What's Going Into Your AI Tools? Let's Find Out.

Book a free AI risk assessment and we'll map exactly what data your finance function is putting into AI tools today — and close the gaps before the OAIC finds them for you.

Growwth Partners   |   +65 9861 5600   |   jd@growwthpartners.com   |   Australia