Assess a suspected breach of client personal information under the notifiable data breach scheme
Key facts
- Human involvement
- RedLawyer-led
- How AI is used
- From the incident log the lawyer has already marked, copy into a fact table the date the practice became aware of the suspicion, what personal information is affected, whether it was accessed, disclosed or lost, who holds it, and what containment has been done. Do not decide whether the breach is eligible, do not draft the statement to the Commissioner or to individuals, and do not read documents the lawyer has marked as not to be opened.
- What the lawyer must review
- The lawyer first decides whether the Privacy Act covers the practice. If it does, the lawyer decides whether there are reasonable grounds to suspect an eligible data breach and completes a reasonable and expeditious assessment. An eligible data breach requires unauthorised access to, unauthorised disclosure of, or loss of personal information, that this is likely to result in serious harm, and that remedial action has not prevented that likely risk. Take all reasonable steps to finish the assessment within 30 calendar days after the day the practice became aware of the suspicion. The lawyer writes any statement to affected individuals and to the Commissioner. Where information is held jointly, if one entity has assessed the suspected breach the others are not required to assess it as well, and only one entity needs to notify the individuals and the Commissioner. The scheme does not prescribe which entity does either. The entities should agree who will assess and who will notify. That agreement is not a condition of the exception.
- Written for / version
- US
Open a jurisdiction version of this task to see which instruments apply: US
Who does what
| Role | What they do |
|---|---|
| Assistance | Supporting preparation only. From the incident log the lawyer has already marked, copy into a fact table the date the practice became aware of the suspicion, what personal information is affected, whether it was accessed, disclosed or lost, who holds it, and what containment has been done. Do not decide whether the breach is eligible, do not draft the statement to the Commissioner or to individuals, and do not read documents the lawyer has marked as not to be opened. The tool writes nothing into the document. Substantive advice, judgement and any restricted content remain with the responsible human. |
| Lawyer | Perform the substantive analysis and decisions. Independently check any permitted supporting work and approve the exact output for its intended use. |
Checklist
- Confirm the Privacy Act covers this practice before any notifiable-data-breach step is treated as mandatory.
- Diary 30 calendar days from the day the practice became aware of the reasonable suspicion, and record why any longer assessment was still all reasonable steps.
- Do not treat containment as the end of the matter unless the lawyer is satisfied the likely risk of serious harm has been prevented.
- The tool's table does not go into the statement to the Commissioner or to individuals. The lawyer writes that statement.
Sources
- OAIC: When to report a data breach · 2026-10-22
- OAIC: Part 4, Notifiable Data Breach scheme · 2026-10-22
These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.