Assess a notifiable data breach and draft the OAIC notification pack
Key facts
- Human involvement
- RedLawyer-led
- How AI is used
- Build an NDB table (access, personal information, likely serious harm), draft OAIC and individual notices, note the 30-day assessment and any 72-hour ransomware report.
- What the lawyer must review
- Decide serious harm yourself; check 30 days from awareness of a suspected breach
- Check the s 27 Cyber Security Act 2024 ransomware report: 72 hours; turnover over $3m
- Note the ransomware penalty is civil, 60 penalty units
- Check SOCI reports to the ACSC in 12 or 72 hours
- Check privilege (Optus v Robertson; McClure v Medibank [2025] FCA 167)
- Check state health records Acts (Vic, NSW, ACT)
Rules that apply
The document starts from the task name. Change it if this piece of work is different.
Who does what
| Role | What they do |
|---|---|
| Assistance | Supporting preparation only. Potential support includes preparing preliminary structure or wording. Confirm the tool’s capability and permitted scope. Substantive advice, judgement and any restricted content remain with the responsible human. |
| Lawyer | Perform the substantive analysis and decisions. Independently check any permitted supporting work and approve the exact output for its intended use. |
Checklist
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.