Under new rules set to take effect Thursday, organisations will face stiff penalties for failing to promptly notify the Australian Information Commissioner and affected individuals when a data breach occurs.