Decide whether a suspected data breach is notifiable
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- From the incident note, copy what information is affected, how it left the client control or was accessed, what remedial step has already been taken, and the date the client became aware. Leave the eligible-breach answer blank. The tool does not write a statement to the Commissioner.
- What the lawyer must review
- The lawyer decides whether the client must assess and whether the breach is eligible. The OAIC page says the scheme applies to entities that must protect personal information under Australian Privacy Principle 11. That includes agencies and organisations with annual turnover of more than $3 million. A small business operator, whose turnover has not been more than $3 million in any financial year since 2001, is covered only in the cases the page lists, and some of those cases cover only the information held for a named activity. Employee records are outside the scheme only where the act or practice is directly related to a current or former employment relationship, and tax-file-number information in an employee record is not exempt. An eligible data breach is unauthorised access, unauthorised disclosure, or loss that is likely to result in serious harm, where remedial action has not prevented that likely risk. Likely means more probable than not, judged by a reasonable person in the entity position. Serious harm is not defined. Section 26WG lists matters that may be considered, including the kind and sensitivity of the information, security measures, who has or could obtain it, and the nature of the harm. If there are reasonable grounds to suspect an eligible breach, section 26WH requires all reasonable steps to finish the assessment within 30 calendar days after the day the entity became aware. If that is not reasonable, the reasons are documented. If there are reasonable grounds to believe there has been an eligible breach, notification is prompt. The lawyer writes any statement. This is not an incident checklist for an artificial-intelligence system, and it is not a ransomware payment report.
- Written for / version
- US
Open a jurisdiction version of this task to see which instruments apply: US
Who does what
| Role | What they do |
|---|---|
| Assistance | Do not begin AI assistance until the responsible lawyer has defined and confirmed its permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Decide whether the client is covered at all before treating the scheme as applying. A small business is covered only in a case the page lists.
- Count 30 calendar days from the day the client became aware of the grounds to suspect, and treat that as the maximum for the assessment.
- If remedial action has made serious harm unlikely, record why notification is not required.
- Do not draft the statement to the Commissioner in this sheet.
Sources
- OAIC: Part 4, Notifiable Data Breach scheme · 2026-10-22
These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.