To bring the data breach provisions into force we're going to have to pass regulations, so we'll need to consult on the regulations and go through that. Then after that's done it's the role of the Privacy Commissioner to help provide guidance to companies about how to comply in these areas.
On February 5th, 2015. See this statement in context.