---
title: "Decide whether a suspected data breach is notifiable"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-whether-a-suspected-data-breach-is-notifiable"
type: "task"
site: "AI Law Framework"
id: "A24-SF20261022-11"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Decide whether a suspected data breach is notifiable

> From the incident note, copy what information is affected, how it left the client control or was accessed, what remedial step has already been taken, and the date the client became aware.…

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-whether-a-suspected-data-breach-is-notifiable  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the incident note, copy what information is affected, how it left the client control or was accessed, what remedial step has already been taken, and the date the client became aware. Leave the eligible-breach answer blank. The tool does not write a statement to the Commissioner. |
| What the lawyer must review | The lawyer decides whether the client must assess and whether the breach is eligible. The OAIC page says the scheme applies to entities that must protect personal information under Australian Privacy Principle 11. That includes agencies and organisations with annual turnover of more than $3 million. A small business operator, whose turnover has not been more than $3 million in any financial year since 2001, is covered only in the cases the page lists, and some of those cases cover only the information held for a named activity. Employee records are outside the scheme only where the act or practice is directly related to a current or former employment relationship, and tax-file-number information in an employee record is not exempt. An eligible data breach is unauthorised access, unauthorised disclosure, or loss that is likely to result in serious harm, where remedial action has not prevented that likely risk. Likely means more probable than not, judged by a reasonable person in the entity position. Serious harm is not defined. Section 26WG lists matters that may be considered, including the kind and sensitivity of the information, security measures, who has or could obtain it, and the nature of the harm. If there are reasonable grounds to suspect an eligible breach, section 26WH requires all reasonable steps to finish the assessment within 30 calendar days after the day the entity became aware. If that is not reasonable, the reasons are documented. If there are reasonable grounds to believe there has been an eligible breach, notification is prompt. The lawyer writes any statement. This is not an incident checklist for an artificial-intelligence system, and it is not a ransomware payment report. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Lawyer review required**

The responsible lawyer reviews the work against the instructions, sources and intended use.

- What the AI does: From the incident note, copy what information is affected, how it left the client control or was accessed, what remedial step has already been taken, and the date the client became aware. Leave the eligible-breach answer blank. The tool does not write a statement to the Commissioner.
- What the lawyer does: The lawyer decides whether the client must assess and whether the breach is eligible. The OAIC page says the scheme applies to entities that must protect personal information under Australian Privacy Principle 11. That includes agencies and organisations with annual turnover of more than $3 million. A small business operator, whose turnover has not been more than $3 million in any financial year since 2001, is covered only in the cases the page lists, and some of those cases cover only the information held for a named activity. Employee records are outside the scheme only where the act or practice is directly related to a current or former employment relationship, and tax-file-number information in an employee record is not exempt. An eligible data breach is unauthorised access, unauthorised disclosure, or loss that is likely to result in serious harm, where remedial action has not prevented that likely risk. Likely means more probable than not, judged by a reasonable person in the entity position. Serious harm is not defined. Section 26WG lists matters that may be considered, including the kind and sensitivity of the information, security measures, who has or could obtain it, and the nature of the harm. If there are reasonable grounds to suspect an eligible breach, section 26WH requires all reasonable steps to finish the assessment within 30 calendar days after the day the entity became aware. If that is not reasonable, the reasons are documented. If there are reasonable grounds to believe there has been an eligible breach, notification is prompt. The lawyer writes any statement. This is not an incident checklist for an artificial-intelligence system, and it is not a ransomware payment report.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.

## Checks the lawyer makes

1. Decide whether the client is covered at all before treating the scheme as applying. A small business is covered only in a case the page lists.
2. Count 30 calendar days from the day the client became aware of the grounds to suspect, and treat that as the maximum for the assessment.
3. If remedial action has made serious harm unlikely, record why notification is not required.
4. Do not draft the statement to the Commissioner in this sheet.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [OAIC: Part 4, Notifiable Data Breach scheme](https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-4-notifiable-data-breach-ndb-scheme) (checked 2026-10-22)

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-whether-a-suspected-data-breach-is-notifiable/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*