---
title: "Assess a notifiable data breach and draft the OAIC notification pack"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack/commonwealth"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-T1-R3-CTH"
practice_area: "Privacy, Data Protection & Cyber"
tier: "red"
lawyer_review: "required"
jurisdictions: ["CTH"]
last_reviewed: "2026-09-23"
---

# Assess a notifiable data breach and draft the OAIC notification pack

> Build an NDB table (access, personal information, likely serious harm), draft OAIC and individual notices, note the 30-day assessment and any 72-hour ransomware report.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack/commonwealth  
Last reviewed: 2026-09-23

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Red: Lawyer writes; AI may check, clarify or collect data |
| How AI is used | Build an NDB table (access, personal information, likely serious harm), draft OAIC and individual notices, note the 30-day assessment and any 72-hour ransomware report. |
| What the lawyer must review | Decide serious harm yourself; check 30 days from awareness of a suspected breach Check the s 27 Cyber Security Act 2024 ransomware report: 72 hours; turnover over $3m Note the ransomware penalty is civil, 60 penalty units Check SOCI reports to the ACSC in 12 or 72 hours Check privilege (Optus v Robertson; McClure v Medibank [2025] FCA 167) Check state health records Acts (Vic, NSW, ACT) |
| Written for | Commonwealth |
| Applies to | [Assess a suspected data breach and draft the notification pack](https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack.md) |

## Checking plan

**Source-by-source verification**

Trace relied-on content to independent sources and check for relevant material the output has missed.

- What the AI does: Potential support includes organising research leads and preparing preliminary structure or wording. Confirm the tool’s capability and permitted scope.
- What the lawyer does: Set the scope, verify the evidence, resolve exceptions and approve the final output for its intended use.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Suggested checking approach based on the task guidance. Complete the assessment for the actual tool, information and jurisdiction.
- Why: The plan reflects the described work and review requirements. Policy colours are not used to determine permission or checking.

## Checks the lawyer makes

1. Trace every relied-on figure to its source, confirm dates and assumptions, and independently recalculate totals or derived amounts.
2. Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
3. Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
4. Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
5. Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.

## Notes

- Confirm the required checking with the responsible lawyer before work starts. The checking approach does not establish permission to use AI.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*