Australian law enforcement agencies and telcos that suffer certain types of data breaches are likely to be exempt from rules requiring them to notify the people affected, under a draft bill.

The federal government published on Thursday an exposure draft of mandatory data breach laws that would compel Australian companies – and in some circumstances overseas companies they pass data on to – to notify customers in the event their personal data has been exposed.

The bill will require Australian entities to notify people whose data they hold in the event of a “serious data breach” that could cause a “real risk of serious harm” if it was released.

Personal data can include anything from credit card information, to medical records, or account and user information for a range of different online services.

The last-minute release of the bill on the final sitting day of parliament formed part of a commitment by the attorney general, George Brandis, to introduce a mandatory notification scheme by the end of year to secure the passage of controversial data retention laws.

But under the current bill, an “enforcement body” could be exempt from notifying people affected by data breaches or publishing any details of the breach generally if the body “believes on reasonable grounds that compliance ... would be likely to prejudice one or more enforcement-related activities conducted by, or on behalf of, the enforcement body”.

Enforcement bodies can also essentially override a direction from the Australian privacy commissioner to make a data breach notification by issuing a certificate if the chief executive officer believes the directions would be prejudicial to their activities.

The exemption means that a wide range of bodies – including the Australian federal police, the Australian Crime Commission and potentially the Australian Border Force – could be exempt from making notifications if they believe such notifications relate to their enforcement activities.

In 2014, the AFP suffered an embarrassing data breach in which it accidentally published highly sensitive information – including metadata – connected to criminal investigations. The breach was only disclosed after Guardian Australia became aware of it. Under the current draft, the AFP would likely be exempt from making a compulsory notification to affected parties.

The new provisions could also inhibit telecommunications companies from disclosing breaches to their customers if they occur in relation to the retention of data and handing it over to law enforcement agencies.

This is because the bill also contains an exemption for “secrecy provisions” that apply to the disclosure of information. Under the Telecommunications (Interception and Access) Act 1979, it is an offence to disclose information about existence or non-existence of a request by a law enforcement agency for telecommunications data.

Brandis said the government would consult extensively with industry and other stakeholders on the proposed scheme to minimise costs and regulatory impact.

The government is taking submissions on the draft bill, and consultation ends in March 2016.

The bill bears strong similarities to a previous bill introduced by Labor senator Lisa Singh in March 2014.

The acting Australian information commissioner, Timothy Pilgrim, welcomed the draft bill and said he strongly supported the development of mandatory data breach notification provisions.

“Notification enables people affected by a breach to take steps to protect their personal information; such as cancelling credit cards or updating log-ins with service providers,” he said.

“A mandatory notification scheme will provide confidence to all Australians that, in the event of a serious data breach, they will be given the opportunity to manage their personal information accordingly.”