Decide which entity assesses a breach of shared information
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- From the contract, copy which party has possession of the records and which party has a right to deal with them. Leave the assessing party blank.
- What the lawyer must review
- The lawyer decides who assesses, where more than one entity holds the information. The page says an entity holds personal information if it has possession or control of the record, including a right or power to deal with it without physical possession. An eligible breach of one holder is also an eligible breach of the others. One holder assessment can meet the assessment duty for the others under section 26WJ. If nobody assesses, each holder may be in breach. The scheme does not say which entity must assess. The page expects the arrangement to be agreed when the contract is made. This decision is who assesses. It is not the later decision about who tells the individuals.
- Written for / version
- US
Open a jurisdiction version of this task to see which instruments apply: US
Who does what
| Role | What they do |
|---|---|
| Assistance | Do not begin AI assistance until the responsible lawyer has defined and confirmed its permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Treat a party with a contractual right to deal with the records as a holder, even if it does not store them.
- Record one assessing entity. Do not assume a supplier assessment covers the client until that is agreed and done.
- If no one has assessed, record that each holder may still have the duty.
- Do not decide in this note who sends the notice to individuals.
Sources
- OAIC: Part 4, Notifiable Data Breach scheme · 2026-10-22
These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.