We’ve all been there, a quiet aside after a meeting, a message sent with good intentions, a casual “Oh, did you hear about…?” It doesn’t feel like gossip in the moment. Sometimes we tell ourselves we’re helping others be supportive, preparing them to show up for someone who’s going through a hard time. But there is a line, and when it’s crossed, what appears to be innocent sharing can become a privacy breach with very real human consequences.

When something goes wrong with personal information two phrases get tossed around a lot: privacy breach and breach of the Privacy Act. They sound similar, and they often get blurred together in day-to-day conversations. But they mean very different things and confusing them can lead to the wrong response by an organisation.

In reality, it’s often both, and recognising the overlap is critical for organisations seeking to comply with the Privacy Act and maintain trust. There’s a strong and sometimes overlooked intersection between fraud and privacy breaches.

When a privacy breach occurs, organisations often consider the impacts to them rather than the impacted individuals. They assess the reputational risks around notification, compliance obligations and legal liability. But what can easily get lost in the noise is consideration for the individuals involved and the harm that has or may occur to them.