The bill applies to organisations subject to the Privacy Act, making it mandatory for them to notify the Australian Information Commissioner and individuals whose data has been affected by an eligible data breach.