Australian privacy breach response checklist
Entities covered by the Privacy Act 1988 must notify eligible data breaches under the Notifiable Data Breaches scheme. This checklist is for privacy officers and lawyers responding to a data breach.
This is a 12-step privacy breach response checklist for entities covered by the Australian Privacy Act. It covers assessment, notification, and remediation.
The checklist
Identify the breach
Identify the unauthorised access, disclosure, or loss of personal information.
Contain the breach
Contain the breach to prevent further access or disclosure.
Assess the scope
Assess the volume, type, and sensitivity of personal information compromised.
Apply NDB threshold
Assess whether the breach is likely to result in serious harm.
Assess in 30 days
Complete the NDB assessment within 30 days of becoming aware.
Prepare NDB statement
Prepare a statement containing the information required by section 26WK.
Notify OAIC
Notify the OAIC using the NDB form as soon as practicable.
Notify affected individuals
Notify affected individuals as soon as practicable.
Consider media notification
Consider whether general public notification is needed if individuals cannot be contacted.
Provide remediation steps
Provide individuals with recommended steps — password reset, credit monitoring.
Document the response
Document the incident, assessment, and response actions in the breach register.
Review and learn
Conduct a post-incident review and update policies and training.
When this checklist applies
Use immediately when a suspected privacy breach is identified.
Common pitfalls
- Missing the 30 day assessment deadline
- NDB threshold applied incorrectly
- OAIC statement missing required elements
- Affected individuals notified too late
- Breach register not maintained
Run this checklist on a real matter
Quillio can help assess NDB obligations and prepare OAIC notification forms. See /practice-areas/firm-management or start a free trial.
General guidance for Australian privacy breach response. Apply specific circumstances and OAIC guidance.
Use this checklist on your matter.
Quillio can run this checklist on a specific NSW conveyancing matter — confirm each item, calculate adjustments, and generate the supporting documents. The free trial requires no credit card.
Start your free trial