Data Breach Notification Plan

Incident Response Team

An effective response relies on knowing exactly who to call when things go wrong. You must have a list of key people and external advisors ready to act immediately. Under the Privacy Act 1988 (Cth), the Notifiable Data Breaches (NDB) scheme requires organisations to take reasonable steps to contain a data breach and assess whether it is likely to result in serious harm. Having a dedicated team is a critical part of meeting this obligation.

Internal Roles and Responsibilities

Business Owner or Managing Director The business owner holds ultimate responsibility for the data breach response. They must make the final decision on whether to notify the Office of the Australian Information Commissioner (OAIC) and affected individuals. They also manage the broader business reputation and customer communications.

Privacy Officer A designated staff member must act as the Privacy Officer. This person coordinates the response and ensures the team follows the plan. Their job is to gather facts, document the timeline of events, and report progress to the business owner. They act as the central point of contact to prevent confusion.

IT or Systems Manager This person handles the technical side of the breach. They work to stop the attack, recover lost data, and secure systems against further access. If you do not have an internal IT department, you must list an external managed service provider (MSP) here.

External Advisors

Legal Counsel You must engage a lawyer experienced in Australian privacy law to assist with complex breaches. Legal privilege protects your early discussions with a lawyer, which helps keep your assessment of the breach confidential. Your lawyer will advise on whether you meet the legal threshold for notification under the NDB scheme. They can also help draft customer notifications to ensure they are accurate and comply with the law.

Cyber Security Specialist For serious incidents like ransomware or hacking, you need a certified cyber security expert. They perform forensic analysis to determine how the breach happened, what data was taken, and how to fix the security gap.

Contact Details List

Maintain a separate, secure sheet with the following details for every team member. Keep a printed copy offline in case your computer systems are locked down during an incident.

• Full Name
• Position title
• Mobile phone number
• Personal email address (in case the business server is down)
• Specific role in the response (Decision Maker, Technical Lead, Coordinator)

Review this list every six months. Update it immediately when staff leave or change roles. A slow response due to outdated contact numbers can lead to greater data loss and regulatory penalties.

Knowing exactly what data you hold and where it sits is the first step in managing a data breach. If you lose track of customer files or you do not know where your employee records are kept, you cannot respond quickly when things go wrong. Under the Privacy Act 1988 (Cth), Australian businesses have specific obligations regarding personal information. If you are unsure whether this law applies to you, check if your business has an annual turnover of more than $3 million or if you trade in personal information. Compliance with the Notifiable Data Breaches (NDB) scheme is mandatory for those entities, meaning you must report eligible data breaches to the Office of the Australian Information Commissioner (OAIC) and affected individuals.

Start by listing every type of information your business collects. Do not limit this to just names and addresses. Think about tax file numbers, bank details, credit card information, medical history, and even photos of job sites that might show licence plates or street addresses. Once you have identified the data, write down exactly where it is stored. This includes obvious places like your accountant's laptop or your office server, but you must also include less obvious locations. Do you have paper files in a ute? Do you use cloud storage like Google Drive or Dropbox? Do customer details sit on a tablet used by staff in the field?

Next, look at the security measures you currently have in place. This allows you to see where your weak spots are. Simple locks on filing cabinets might not be enough. Consider whether your digital files are password protected and if that password is complex. Check if you have two-factor authentication turned on for cloud accounts. Review who actually has access to sensitive data. It is good practice to limit access to only those staff members who need the information to do their job. If you share data with third parties, such as payroll companies or subcontractors, list them as well. Understanding your data inventory makes it much easier to follow the steps in this plan if a breach occurs. Use the table below to map out your business data.

Data Inventory Register

Immediate Containment Checklist

Technical Actions

• Disconnect Affected Devices: Unplug the ethernet cable or disable the Wi-Fi and mobile data connection on any computer, tablet, or phone involved in the breach. This stops the data from leaving your network or malware from spreading to other devices.
• Reset Privileged Credentials: Immediately change passwords for administrator accounts and any compromised user accounts. If you use a central system, force a password reset for all staff who had access to the lost data. Ensure new passwords are strong and unique.
• Disable Remote Access: Turn off remote desktop protocols and VPN access for your business. If the attacker used a remote channel, closing it stops them from getting back in while you investigate.
• Change Website or Banking Logins: If the breach involves website hosting files or internet banking details, change those specific passwords straight away.
• Do Not Reconnect Yet: Keep devices offline until your IT support confirms the threat is removed. Turning a compromised machine back on too quickly can allow the breach to continue or restart.

Physical Actions

• Secure the Physical Site: Lock your office, ute, or storage sheds. If a device was stolen, check who has keys and consider changing locks if spare keys are missing.
• Stop Using Affected Hardware: If a specific laptop or server is the problem, power it down and do not use it for any other work.
• Preserve Evidence: Do not delete files, reformat drives, or wipe devices. You need to keep the system exactly as it is to help your IT provider or authorities work out how the breach happened. If you must turn a machine off, unplug it rather than performing a standard shutdown.
• Collect Logs: If you have physical access to your router or server, write down the exact times you noticed the issue. Take photos of screen messages if they appear.

Legal Note These steps help you meet your obligations under the Privacy Act 1988 (Cth). The Notifiable Data Breaches (NDB) scheme requires you to take reasonable steps to contain a breach once you are aware of it. Acting quickly is a key part of showing the Office of the Australian Information Commissioner (OAIC) that your response was appropriate. Failure to contain a breach swiftly can lead to greater data loss and higher regulatory penalties.

To decide if a data breach is likely to result in serious harm, you must look closely at the type of information involved and who has access to it. Serious harm is not minor. It includes physical injury, serious financial loss, or serious damage to reputation. Under the Privacy Act 1988, you must assess this risk quickly. Use the following questions to guide your assessment.

What kind of data is involved? You must identify if the lost or stolen data includes sensitive information. This is a major risk factor. Examples include medical records, health information, or criminal records. You should also check for financial details like bank account numbers, credit card numbers, or superannuation information. Even basic personal identifiers like a Tax File Number, Medicare number, or driver's licence number can create a high risk of identity theft. If the breach involves only a name or a work phone number, the risk of serious harm is usually lower.

Who has the data? Consider who might hold the data now. If an unknown criminal has the information, the risk is much higher than if an employee accidentally sent it to a trusted business partner. Ask yourself if the person who has the data intends to cause harm. If the data is published on the public internet, the risk is immediate and widespread.

Is the data protected? Check if the lost data is encrypted or password protected. If a stolen laptop requires a strong password to access, or if files are encrypted, the risk of serious harm is reduced. However, if the password is written on a sticker attached to the laptop, the data is not secure. You must assess if the security measures are actually effective.

Could the data be used for fraud? Evaluate if the information helps someone commit identity fraud. A combination of details is dangerous. For example, a full name plus a date of birth and address is very useful for a scammer. If tradespeople have client credit card details, scammers can use these to make unauthorised transactions. If criminals can access a client's MyGov account using stolen details, the harm is serious.

What are the consequences for the individual? Think about the specific impact on your clients. If their private medical history becomes public, it could damage their reputation or relationships. If their banking details are stolen, they could lose significant savings. Consider if the individuals are vulnerable. For example, if the data belongs to elderly clients or children, the risk of serious harm may be higher.

Review these questions carefully. If you answer yes to the high-risk indicators, you must assume there is a likelihood of serious harm. Under the Notifiable Data Breaches (NDB) scheme, this triggers your obligation to notify the Office of the Australian Information Commissioner (OAIC) and the affected individuals.

Customer Notification Letter Template

[Date]

[Customer Name]

[Customer Address]

Dear [Customer Name],

We are writing to let you know about a data breach involving your personal information. We take the security of your data seriously and we wanted to explain what happened, what we are doing, and what steps you might need to take.

What happened On [date], we discovered that [brief description of the incident, e.g. a laptop was left in a vehicle / a file was emailed to the wrong person]. This incident may have exposed your [list specific data, e.g. name, address, phone number, bank account details].

What we have done Since discovering the issue, we have:

• Secured the system to stop further data loss.
• Launched an investigation to find out exactly what happened.
• [List other actions, e.g. reset passwords / notified police].

What you should do Because your information was involved, we recommend you take the following steps: [Provide specific advice here based on the data lost, for example:

• Monitor your bank accounts for unusual transactions.
• Change your password for your account with us.
• Contact your financial institution if you provided bank details.]

We apologise for any stress or inconvenience this causes. If you have any questions about this incident, please contact [Name] on [Phone Number] or at [Email Address].

Yours sincerely,

[Name] [Position] [Business Name]

Notifying the Office of the Australian Information Commissioner (OAIC)

If the breach is likely to result in serious harm to any individual, you must notify the OAIC as soon as practicable. You must do this under the Privacy Act 1988 (Cth).

You can notify the OAIC using the Notifiable Data Breaches (NDB) form on their website. Do not wait until you finish your investigation to notify them. You must provide the following information in your notification.

First, describe the breach. Explain how the breach happened and what personal information was involved. Be specific about the type of data lost, such as tax file numbers, medical records, or credit card details.

Second, outline the steps you have already taken to fix the breach. This shows the OAIC you are managing the situation. List the actions you took to reduce the impact on affected individuals. This includes things like remote wiping devices, changing passwords, or contacting banks.

Third, describe the steps you are taking to prevent the breach from happening again. The OAIC wants to know you have reviewed your security measures. You might mention new staff training, updated software, or physical security improvements.

Finally, provide details about the individuals you have notified. Confirm that you have contacted the people affected by the breach. If you have not notified them yet, explain why and when you plan to do so. Keep a record of your submission to the OAIC for your own business files.

Post-Incident Meeting Requirements

After a data breach is contained, you must hold a post-incident meeting. This meeting is essential for understanding what went wrong and preventing it from happening again. You must schedule this meeting within a reasonable timeframe, usually within one week of resolving the incident. All relevant staff must attend. This includes business owners, office managers, and anyone who handled the breach response. If you used external IT support or a legal advisor, they should join too.

Documenting the Cause

The primary goal of this meeting is to identify the root cause of the breach. You must document the exact sequence of events. Start from when the breach began and trace it through to discovery. Ask specific questions. Was the breach caused by a phishing email, a lost mobile phone, or outdated software? Did a staff member make a mistake, or did a system fail?

You must record these findings in writing. Create a Post-Incident Report. This report must detail the cause, the data exposed, and who was affected. This documentation is a legal requirement under the Privacy Act 1988 (Cth). The Office of the Australian Information Commissioner (OAIC) may request this report during an investigation. If you cannot prove you investigated the cause, you risk penalties for failing to take reasonable steps to secure information.

Updating Security Policies

Once the cause is known, you must review your security policies. If the breach happened because an employee clicked a bad link, your training policy is lacking. If a thief stole a laptop from a work van, your device storage policy is too weak. You must update your Data Breach Response Plan to address the specific failure.

Review your compliance with the Notifiable Data Breaches (NDB) scheme. Ensure your updated policies align with the Australian Privacy Principles. For example, APP 11 requires you to take reasonable steps to protect personal information. If your current steps failed, you must implement stronger controls. This might include two-factor authentication, mandatory regular password changes, or encrypting all customer data.

Action Items and Follow-Up

The meeting must conclude with a list of action items. Assign a specific person to every task. Set deadlines for implementing new security measures. Do not rely on verbal agreements. Write down who is doing what and when.

Finally, schedule a follow-up meeting. This allows you to check if the new policies are working. Continuous improvement shows the OAIC you take privacy seriously. It also builds trust with your clients. A small business owner who learns from a breach demonstrates professionalism and responsibility.