---
title: "Draft the statement to the OAIC about a notifiable data breach from the incident log"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-the-statement-to-the-oaic-about-a-notifiable-data-breach-from-the"
type: "task"
site: "AI Law Framework"
id: "A25-B15-1"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["CTH"]
last_reviewed: "2026-10-22"
---

# Draft the statement to the OAIC about a notifiable data breach from the incident log

> Draft the statement using only facts written in the incident log.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-the-statement-to-the-oaic-about-a-notifiable-data-breach-from-the  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Draft the statement using only facts written in the incident log. |
| What the lawyer must review | Match every affected group and every step to the log and to the OAIC notifiable data breaches page. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Source-by-source verification**

The statement has to match the incident log and the OAIC notifiable data breaches page. A generated statement can invent who was affected or what was done.

- What the AI does: Draft the statement using only facts written in the incident log.
- What the lawyer does: Match every affected group and every step to the log and to the OAIC notifiable data breaches page.
- Basis: Checked against the linked public source on 10 October 2026.
- Written for: AU

## Notes

- Forum: Office of the Australian Information Commissioner. Document: Notifiable data breach statement.
- Main AI risk: The statement has to match the incident log and the OAIC notifiable data breaches page. A generated statement can invent who was affected or what was done.

## Sources

- [OAIC: Notifiable data breaches](https://www.oaic.gov.au/privacy/notifiable-data-breaches) (checked 2026-10-10)
- [Privacy Act 1988](https://www.legislation.gov.au/C2004A03712/latest) (checked 2026-10-10)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [Notification of an eligible data breach to affected individuals (Privacy Act s 26WL), with the public-notice option](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/eligible-data-breach-notification-to-individuals.md) | Notice | Yellow | Plain-language notice to individuals whose information was involved in an eligible data breach, carrying the four matters s 26WK(3) requires, practical steps to reduce harm and support contacts,… |

Signed-in accounts can read the full text of each one.

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-the-statement-to-the-oaic-about-a-notifiable-data-breach-from-the/united-states.md) | Red |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*