Handling Sensitive Information: What to Check Before You Share
October 22, 2026
In the first half of 2025, Australian organisations reported 532 data breach notifications to the Office of the Australian Information Commissioner. Thirty-seven per cent of them, around four in ten, were not caused by hackers or malware. They were caused by people doing their jobs.
An email sent to the wrong recipient. The wrong file attached. A document uploaded to a tool that hasn’t been approved for work use. According to OAIC data, the most common human error breach in Australia remains personal information sent to the wrong email address, accounting for 42 per cent of all human error notifications in the second half of 2024.
These aren’t careless employees. They’re experienced people working quickly. The mistake just needed one more second.
What is sensitive information?
Under Australia’s Privacy Act 1988 and the Notifiable Data Breaches scheme, organisations are required to protect personal information and to notify the OAIC when a breach is likely to result in serious harm. In practice, sensitive information shows up across most work functions.
It includes personally identifiable information (PII): names, addresses, dates of birth, Medicare numbers and contact details. It includes financial records, account numbers, payment details, salary information and credit files. Health information, employment records, source code, client lists, legal documents and authentication data such as passwords and MFA recovery codes are all sensitive, as is internal strategy and unreleased commercial detail.
Some of this looks innocuous in isolation. A name alone may not cause harm. Combined with a postcode and a date of birth, it can identify a person precisely enough to cause significant damage. The sensitivity of information often depends on what it’s combined with, not just what it is on its own.
How sensitive information gets exposed
The OAIC data covers the reported cases under mandatory notification obligations. The everyday exposures are wider.
The most common channels for human error in Australian data breaches, consistently across reporting periods:
- Personal information sent to the wrong email recipient.
- Unintended publication of data, including documents posted to public-facing systems.
- Failure to use BCC when sending email to groups.
- The wrong file attached to an otherwise correct message.
- Documents uploaded to unapproved tools, including online AI tools.
That last category is growing. IBM’s 2025 Cost of a Data Breach Report found that shadow AI, where employees use unapproved AI tools to handle work tasks, contributed to one in five data breaches studied, adding an average of USD 670,000 to breach costs. Employees who upload documents, paste client details or enter business data into personal AI accounts create exposures their organisations may not detect for months.
The offline exposures still apply. Printed documents left on desks, screens visible in public spaces, conversations held in shared areas. Sensitive information doesn’t stop being sensitive because the exposure route is physical rather than digital.
What to check before you share
Most human error breaches share a common cause: the decision to share happened faster than the check that should have preceded it. These questions take less than ten seconds each.
Do I actually need to share this? Only share, collect or retain what’s necessary for the purpose. Data minimisation is both a Privacy Act principle and a practical risk reduction measure.
Is this going to the right person? Check the recipient field before sending, especially in email. Auto-complete errors are one of the most common causes of misdirected email. If you’re sending to multiple recipients, check each one.
Is the attachment the right file? If there’s any chance it’s not what you think, open it before sending.
Is the tool approved? Before uploading a document to any online tool, including AI tools, translation services, PDF editors and cloud storage, confirm it’s on your organisation’s approved list.
Does this request feel unusual? Scammers impersonate customers, suppliers, executives and colleagues to obtain sensitive information. If a request comes with urgency or secrecy, verify through a trusted contact method before responding.
What to do when something goes wrong
Report it immediately. Under the Notifiable Data Breaches scheme, organisations have specific obligations when a breach is likely to result in serious harm to affected individuals, and the window for internal assessment and notification matters.
Fast reporting gives your IT and legal teams the best chance of containing the impact, assessing what was exposed, and meeting notification requirements. The OAIC data shows the range of impact is wide: five incidents in 2024 affected more than one million individuals. Early reporting changes what the outcome looks like.
