Notifiable Data Breaches - Prepare Questions for Your Professional

Notifiable Data Breaches - Prepare Questions for Your Professional

If personal information may have been exposed, gather the facts and questions to hand to your professional fast. This skill helps you prepare - it is not legal advice, and you must not decide your obligations from it.

When to use

After a suspected or confirmed breach where customer, staff or other personal information might be involved, and you need to be ready for a conversation with your privacy or legal professional (or Privacy Officer) about the Notifiable Data Breaches (NDB) scheme.

Steps

1. Know the boundary: whether the NDB scheme applies, whether a breach is "eligible", and who must be told are decisions for your professional - this skill only helps you prepare for that conversation. 2. Write down the facts: what information was involved, whose information, roughly how many people, when it happened, and when you found out. 3. Note whether the exposure is contained now or still ongoing, and what you've already done to limit the harm. 4. Assume a clock may be running - data-breach rules can carry strict timeframes - so prepare quickly rather than waiting. 5. Draft questions for your professional, such as: Are we covered by the Privacy Act 1988? Is this an eligible data breach? What is the assessment timeframe? Do we need to notify the OAIC and affected individuals, and how? What should we tell affected people? 6. Ask what support to offer affected individuals - for example, directing them to IDCARE, Australia and New Zealand's free identity and cyber support service. 7. Keep a written record of your assessment, your decisions, and the advice you receive.

When to call a professional

Always for this topic - engage your privacy or legal professional (or Privacy Officer), and refer to the OAIC for the official scheme. Use this skill only to arrive prepared, never to self-assess your obligations.

ACSC reference: Points to the OAIC Notifiable Data Breaches scheme under the Privacy Act 1988; pair with ACSC incident response guidance (cyber.gov.au/smallbusiness). Preparation only - not legal advice.