Data breach response plan: a practical guide for Australian businesses

Notification thresholds, reporting deadlines and who must be told generate the strongest operator concern. Ownership, evidence and post-breach review appear less often publicly, but are recurring causes of delayed or ineffective responses.

• Privacy Act-covered organisation or agency — Build the NDB assessment and OAIC and individual notification steps directly into the plan.
• small business with annual turnover of $3 million or less — Do not assume exemption: some small businesses are covered because of health services, trading in personal information, related-body status, credit reporting, tax file numbers or other statutory exceptions.
• business with a broader cyber incident response plan — Cross-reference technical containment and recovery, but retain a breach-specific privacy assessment, notification and communications runbook.

Every suspected loss, unauthorised access or unauthorised disclosure of personal information must be reported immediately to [privacy or breach-response role]. The organisation will activate this plan without waiting for proof of harm, contain and remediate the breach, assess whether it is an eligible data breach, make all required notifications and document the decision and response. No person may conceal, minimise or independently resolve a suspected data breach without reporting it.

• Privacy Act-covered entity — Apply the three-part eligible-data-breach test and document the facts, risk analysis and remedial action.
• entity outside the NDB scheme — The statutory NDB notification test may not apply, but contractual, sector, state, overseas or voluntary notification duties may still apply.
• breach involving vulnerable people or sensitive information — Escalate quickly because identity, health, financial, family-violence and safety consequences can materially increase the likelihood and seriousness of harm.

The organisation will treat a breach as an eligible data breach when: (1) personal information has been accessed or disclosed without authority, or lost in circumstances where unauthorised access or disclosure is likely; (2) a reasonable person would conclude that serious harm to one or more affected individuals is likely; and (3) remedial action has not prevented that likely risk of serious harm. The assessment must consider the information involved, the circumstances and recipients, existing protections, likely misuse, affected individuals and all effective remedial action.

• cyber-enabled data breach — Run technical containment, forensic preservation and the privacy assessment in parallel rather than waiting for complete system recovery.
• human-error breach such as a misdirected email — Attempt recovery or deletion immediately, verify whether the recipient accessed or retained the information and assess whether remediation actually prevented likely serious harm.

The response will follow four connected steps: CONTAIN — stop further loss, access or disclosure while preserving evidence; ASSESS — establish the facts, affected information and people, likely serious harm and effectiveness of remedial action; NOTIFY — make all legally required and risk-reducing notifications as soon as practicable; REVIEW — identify root causes, correct control failures, record lessons and update this plan. These steps may run at the same time and must not be treated as approval gates that delay urgent action.

• Privacy Act-covered entity with a suspected eligible breach — Record the awareness date and time, begin the assessment promptly and treat 30 calendar days as the outer limit.
• entity that forms a reasonable belief before assessment is complete — Move to notification as soon as practicable; do not wait for day 30 or for every forensic question to be closed.
• organisation with multiple business units or outsourced providers — Require immediate central escalation because knowledge held by appropriate personnel can start the assessment obligation.

Suspected data breaches must be reported immediately. The Breach Lead must record when the organisation first became aware of the grounds or information causing suspicion and commence a reasonable and expeditious assessment. Where the NDB scheme applies, all reasonable steps must be taken to complete the assessment within 30 calendar days after that day. Thirty days is the maximum assessment period, not permission to delay. Once there are reasonable grounds to believe an eligible data breach occurred, required notifications must be made as soon as practicable.

• eligible data breach affecting identifiable individuals — Notify the OAIC and the people at likely risk of serious harm, using clear language and actionable recommendations.
• direct individual notification is impracticable — Publish the OAIC statement on the entity's website and take reasonable steps to bring it to the attention of people at risk.
• breach involving jointly held information or a service provider — Agree promptly which entity will assess and notify; ordinarily the entity with the most direct relationship is best placed, but all parties remain exposed if nobody acts.

When an eligible data breach is established, the organisation must provide the required statement to the OAIC and notify individuals at likely risk of serious harm as soon as practicable. The notification must state the organisation’s name and contact details, describe the breach, identify the kinds of information involved and recommend practical steps individuals should take. Communications must be accurate, in plain English, coordinated across affected entities and approved without delaying the statutory notification.

• business carrying on business in Australia with previous-year annual turnover exceeding $3 million — If it makes or becomes aware of a ransomware payment connected to the incident, assess the Cyber Security Act reporting obligation immediately.
• responsible entity for a critical infrastructure asset covered by Part 2B of the Security of Critical Infrastructure Act — The ransomware payment reporting regime can apply independently of the ordinary turnover test.
• Privacy Act-covered entity affected by ransomware data theft — Run the 30-day NDB assessment and any 72-hour payment-reporting clock in parallel; one report does not automatically discharge the other.

The Breach Lead must maintain a reporting matrix for every incident. The matrix must separately assess the Privacy Act NDB scheme, the Cyber Security Act ransomware payment reporting obligation, the Security of Critical Infrastructure Act, sector-regulator rules, law-enforcement and cyber.gov.au reporting, cyber-insurance notice conditions, contracts and any overseas law. If a covered ransomware payment is made, or the organisation becomes aware that one was made on its behalf, the required report must be submitted within 72 hours while all other assessments continue.

• small business without dedicated privacy or security staff — Name the owner or senior manager as accountable sponsor and pre-arrange external legal, IT forensic, communications and insurance contacts.
• larger or regulated organisation — Use a multidisciplinary response team with explicit decision rights, alternates, escalation thresholds and board reporting.
• business using outsourced technology or data processors — Include contractual escalation contacts, evidence-access rights, joint assessment arrangements and notification responsibilities.

Plan Owner: [role]. Accountable Executive: [role]. The Plan Owner may activate the response team, direct containment and evidence preservation, obtain urgent professional advice, commence the NDB assessment and escalate notification decisions. The plan must identify primary and alternate contacts, decision authorities, after-hours escalation, assessment and notification procedures, communication templates, external advisers, recordkeeping requirements and post-breach review actions. Contact details and authorities must be kept current.

• ISM-aligned organisation — Exercise the associated cyber incident response plan at least annually and retain evidence of findings and remediation.
• Privacy Act-covered entity — Document every suspected breach assessment and outcome, including why notification was or was not required.
• business dependent on third-party providers — Test whether providers can meet escalation, evidence, containment and joint-notification requirements within the legal clocks.

The organisation must retain a complete record of each suspected or confirmed data breach, including the initial report and awareness time, containment actions, evidence preserved, affected information and individuals, serious-harm assessment, remedial action, decisions and approvals, external advice, regulatory and individual notifications, communications, costs, root-cause review and corrective actions. Exercises must record the scenario, participants, decisions, delays, control gaps, assigned owners and completion of remediation.

• multi-entity or outsourced service arrangement — Assign assessment, evidence access, decision rights and notification responsibilities in writing before a breach.
• business relying on a generic incident template — Add the NDB serious-harm test, awareness timestamp, 30-day outer limit, notification options and separate reporting matrix.
• workforce handling personal information manually — Use a no-concealment reporting culture, simple escalation route and controls that reduce address, attachment and recipient errors.

Thirty days is not a waiting period, proof of actual misuse is not required before serious harm can be likely, and an attempted recall or deletion request is not treated as successful remediation unless its effectiveness is established. Containment must preserve relevant evidence. Staff will not be disciplined merely for promptly reporting an honest mistake; concealment, delay, deliberate misuse or failure to cooperate may be handled separately under applicable workplace policies and law.

This guide and its templates are a professionally drafted starting point, not legal advice. Your obligations depend on your industry, your contracts and your data. Have a qualified adviser review anything high stakes before you rely on it.