Data Breach Notification Plan

1. Document Control

Business Name: Smith's Plumbing Services Pty Ltd ABN: 12 345 678 901 Date Prepared: 01/07/2023 Review Date: 01/07/2024 Prepared By: John Smith

2. Response Team

Role	Name	Contact Number	Email
Privacy Officer / Business Owner	John Smith	0412 345 678	john@smithplumbing.com.au
IT Support / Technical Contact	City IT Solutions	03 9000 0000	support@cityit.com.au
Legal Advisor	Melbourne Legal Partners	03 9000 1111	advice@mlp.com.au
Communications Contact	Sarah Smith	0412 345 679	sarah@smithplumbing.com.au

3. Data Inventory

Data Type	Storage Location	Security Measures in Place
Customer Names & Addresses	Xero Cloud Accounting	2FA enabled, Strong Passwords
Financial Records (Bank Details)	Xero Cloud Accounting	2FA enabled, Limited user access
Employee Records	Myob & Locked Filing Cabinet	Password protected, Physical lock

4. Immediate Response Steps

Step 1: Contain the Breach

• Called City IT Solutions to revoke access for stolen laptop.
• Changed admin passwords for Xero.

Step 2: Assemble the Team

• John Smith (Owner) notified.
• Sarah Smith (Office Manager) notified.

Step 3: Initial Assessment

• What happened: Company laptop stolen from ute overnight.
• When did it happen: Overnight on 15/10/2023.
• Who discovered it: John Smith, 06:30 AM 16/10/2023.
• What data is involved: Client quotes and invoices containing names, addresses, and partial bank account details (BSB/Account). No passwords or credit card numbers.
• How many people are affected: Approximately 45 clients from the last 3 months.

5. Assessment of Serious Harm

Factor	Yes / No	Notes
Is the information sensitive?	Yes	Bank details are present.
Is the information in the hands of someone likely to misuse it?	Unknown	Laptop was password protected but drive may not be fully encrypted.
Is there a risk of identity theft?	Low	Limited info, but bank details are a risk.
Is there a risk of financial loss?	Yes	Bank details could be used for fraud.
Is there a risk of physical safety?	No

Decision: YES - Eligible data breach requiring notification due to presence of bank details.

6. Notification Procedures

A. Notify the OAIC

• Submitted online form on 16/10/2023.

B. Notify Affected Individuals

• Method: Email and SMS for immediate receipt. Follow up letter for those without email.

Draft Statement: Dear [Client Name],

We are writing to inform you of a data breach involving your personal information held by Smith's Plumbing Services.

What happened: On 16 October 2023, we discovered that a company laptop was stolen from a vehicle. The laptop contained files with your personal information.

What information was involved: The files included your name, address, and bank account details (BSB and Account Number). The laptop did not contain your tax file number or credit card details.

What we are doing: We have remotely disabled the laptop's access to our systems. We have reported the theft to the police. We are currently reviewing our security to ensure this does not happen again.

What you should do: We recommend you monitor your bank accounts for any unusual transactions over the coming weeks. If you notice anything suspicious, please contact your bank immediately.

We sincerely apologise for this incident. If you have questions, please call John on 0412 345 678.

Sincerely, Smith's Plumbing Services