---
title: "Assess a suspected breach of client personal information under the notifiable data breach scheme"
url: "https://ailawframework.com/obligations/confidentiality-and-client-information/assess-a-suspected-breach-of-client-personal-information-under-the-notif"
type: "task"
site: "AI Law Framework"
id: "A51-MA20261022-1"
practice_area: "Confidentiality & client information"
tier: "red"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Assess a suspected breach of client personal information under the notifiable data breach scheme

> From the incident log the lawyer has already marked, copy into a fact table the date the practice became aware of the suspicion, what personal information is affected, whether it was accessed, disclosed or lost, who…

Canonical page: https://ailawframework.com/obligations/confidentiality-and-client-information/assess-a-suspected-breach-of-client-personal-information-under-the-notif  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Confidentiality & client information](https://ailawframework.com/obligations/confidentiality-and-client-information.md) |
| Human involvement | Red: Lawyer writes; AI may check, clarify or collect data |
| How AI is used | From the incident log the lawyer has already marked, copy into a fact table the date the practice became aware of the suspicion, what personal information is affected, whether it was accessed, disclosed or lost, who holds it, and what containment has been done. Do not decide whether the breach is eligible, do not draft the statement to the Commissioner or to individuals, and do not read documents the lawyer has marked as not to be opened. |
| What the lawyer must review | The lawyer first decides whether the Privacy Act covers the practice. If it does, the lawyer decides whether there are reasonable grounds to suspect an eligible data breach and completes a reasonable and expeditious assessment. An eligible data breach requires unauthorised access to, unauthorised disclosure of, or loss of personal information, that this is likely to result in serious harm, and that remedial action has not prevented that likely risk. Take all reasonable steps to finish the assessment within 30 calendar days after the day the practice became aware of the suspicion. The lawyer writes any statement to affected individuals and to the Commissioner. Where information is held jointly, if one entity has assessed the suspected breach the others are not required to assess it as well, and only one entity needs to notify the individuals and the Commissioner. The scheme does not prescribe which entity does either. The entities should agree who will assess and who will notify. That agreement is not a condition of the exception. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Lawyer-led judgement**

The lawyer makes the substantive assessment. Any permitted AI assistance remains supporting work with its own checks.

- What the AI does: From the incident log the lawyer has already marked, copy into a fact table the date the practice became aware of the suspicion, what personal information is affected, whether it was accessed, disclosed or lost, who holds it, and what containment has been done. Do not decide whether the breach is eligible, do not draft the statement to the Commissioner or to individuals, and do not read documents the lawyer has marked as not to be opened.
- What the lawyer does: The lawyer first decides whether the Privacy Act covers the practice. If it does, the lawyer decides whether there are reasonable grounds to suspect an eligible data breach and completes a reasonable and expeditious assessment. An eligible data breach requires unauthorised access to, unauthorised disclosure of, or loss of personal information, that this is likely to result in serious harm, and that remedial action has not prevented that likely risk. Take all reasonable steps to finish the assessment within 30 calendar days after the day the practice became aware of the suspicion. The lawyer writes any statement to affected individuals and to the Commissioner. Where information is held jointly, one holder's assessment and notice can satisfy the group only if that arrangement is actually in place.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.
- Restriction: The lawyer makes the substantive assessment. Any permitted AI assistance remains supporting work with its own checks.

## Checks the lawyer makes

1. Confirm the Privacy Act covers this practice before any notifiable-data-breach step is treated as mandatory.
2. Diary 30 calendar days from the day the practice became aware of the reasonable suspicion, and record why any longer assessment was still all reasonable steps.
3. Do not treat containment as the end of the matter unless the lawyer is satisfied the likely risk of serious harm has been prevented.
4. The tool's table does not go into the statement to the Commissioner or to individuals. The lawyer writes that statement.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [OAIC: When to report a data breach](https://www.oaic.gov.au/privacy/notifiable-data-breaches/when-to-report-a-data-breach) (checked 2026-10-22)
- [OAIC: Part 4, Notifiable Data Breach scheme](https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-4-notifiable-data-breach-ndb-scheme) (checked 2026-10-22)

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/obligations/confidentiality-and-client-information/assess-a-suspected-breach-of-client-personal-information-under-the-notif/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*