Skip to content

Breach Notification Summary

Last Updated: 19 October 2026 | Version 2.2

This summary outlines Duely's approach to identifying, managing, and notifying affected parties of a data breach, in compliance with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth).

1. What Constitutes an Eligible Data Breach?

An eligible data breach occurs when:

  1. there is unauthorised access to, unauthorised disclosure of, or loss of personal information held by Duely; AND
  2. it is likely to result in serious harm to any of the individuals to whom the information relates; AND
  3. Duely has not been able to prevent the likely risk of serious harm with remedial action.

2. How We Respond to a Breach

If a potential data breach is detected, Duely follows these steps:

  • Containment: Step one is to secure the systems and contain the breach to prevent further unauthorised access or loss.
  • Assessment: We assess the scope of the breach, the type of data involved, and the root cause. Under the NDB scheme we must take all reasonable steps to complete this assessment within 30 days of becoming aware of the grounds for suspicion (Privacy Act section 26WH). We assess the breach against the Australian test, whether it is likely to result in serious harm to any individual, not only against the GDPR or other overseas law that binds our providers.
  • Breaches at our providers: Our identity verification provider must notify us of a breach within 48 hours of confirming it, and our AI provider within 48 hours of becoming aware of it. Our DVS gateway must comply with our agreement with the agency that administers the Document Verification Service. Our email provider (United States), error-monitoring provider (Germany, with sub-processors in the United States and other countries) and payment provider (United States and other countries) notify us under their standard data processing terms. Our 72-hour commitment to Firms below runs from when we become aware, including when a provider tells us.
  • Remediation: We take prompt remedial action to mitigate vulnerabilities and reduce the likelihood of serious harm to individuals.
  • Root cause analysis: Following containment and remediation, Duely conducts a root cause analysis to identify the underlying cause and prevent recurrence.
  • Preventive measures: Findings from the root cause analysis are used to improve security controls and processes. Duely will share a summary of its findings with affected Firms on request.

3. Notification to Subscribing Firms (Data Controllers)

Duely acts primarily as a Data Processor on behalf of the Firm (the Data Controller). If Duely becomes aware of an actual or reasonably suspected data breach affecting a Firm's tenant data:

  • we will notify the designated Administrator / AMLCO of the affected Firm(s), and any additional contact the Firm has nominated in writing, without undue delay, and no later than 72 hours after becoming aware of it. Duely becomes aware once it has reasonable grounds to suspect a breach, which may precede completion of its investigation. This is the same commitment as section 5 of our Data Processing Agreement, which forms part of the Master Subscription Agreement;
  • our notification to the Firm will include:
    • a description of the data breach;
    • the type of information involved (for example, identity documents, contact details, system logs);
    • the steps Duely has taken;
    • recommended steps the Firm should take in response; and
    • Duely's contact details for further coordination.

4. Notification to the OAIC and Individuals

Under the NDB scheme, where an eligible data breach involves data jointly held by Duely (the processor) and the Firm (the controller), notification of the Office of the Australian Information Commissioner (OAIC) and the affected individuals by one entity is treated as notification by both (Privacy Act section 26WM). If neither notifies, both are in breach. The statement to the OAIC must identify the entity, describe the breach, state the kinds of information involved and recommend steps individuals should take (section 26WK), and individuals are told as soon as practicable after it is prepared (section 26WL).

  • Primary responsibility: Duely and the Firm agree which of them notifies the OAIC and the affected individuals. If they do not agree, the Firm, as the Data Controller managing the direct relationship with the end client, notifies, with Duely's assistance (section 5 of the Data Processing Agreement).
  • Fallback: if the Firm has not notified within five business days after both have concluded that the breach is an eligible data breach, or sooner where delay would increase the risk of serious harm to the affected individuals, Duely may notify the OAIC and the affected individuals itself, after consulting the Firm's AMLCO, leaving out anything whose disclosure would or could contravene section 123 of the AML/CTF Act.
  • Government verification services: where a breach involves information obtained through a government verification service, Duely notifies the affected individuals as its agreement with the agency administering that service requires, after consulting the Firm's AMLCO.
  • Cooperation: Duely will cooperate with the Firm and provide the technical information it holds, and assistance to allow the Firm to fulfil its statutory notification obligations. Duely and the Firm will coordinate any required notification; this does not remove either party's own obligations under the NDB scheme.

4A. Duely's Independent NDB Obligations

In addition to its obligations as a Data Processor on behalf of Firms, Duely independently holds certain personal information (for example, subscriber contact details, billing information, and support correspondence). If an eligible data breach affects this independently held data, Duely will directly comply with its own obligations under the NDB scheme, including notifying the OAIC and affected individuals as required by law. Duely is also bound by the Australian Privacy Principles for the information it processes for Firms, and the fallback in section 4 applies where a Firm does not notify.

5. Contact

If a Firm suspects a data breach or anomalous activity within their Duely tenant, they must immediately report it to support@duely.com.au.

6. Version History

  • 2.2 (19 October 2026; for a Firm that accepted an earlier version, changes adverse to it take effect 30 days after Duely emails its administrator, and other changes on publication): sections 2 and 4 updated.
  • 2.1 (14 October 2026): sections 2, 3 and 4 updated.
  • 2.0 (19 May 2026): revised summary.
  • 1.0 (12 March 2026): first published version.