---
title: "Decide which entity assesses a breach of shared information"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-which-entity-assesses-a-breach-of-shared-information"
type: "task"
site: "AI Law Framework"
id: "A24-SF20261022-12"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Decide which entity assesses a breach of shared information

> From the contract, copy which party has possession of the records and which party has a right to deal with them. Leave the assessing party blank.

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-which-entity-assesses-a-breach-of-shared-information  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the contract, copy which party has possession of the records and which party has a right to deal with them. Leave the assessing party blank. |
| What the lawyer must review | The lawyer decides who assesses, where more than one entity holds the information. The page says an entity holds personal information if it has possession or control of the record, including a right or power to deal with it without physical possession. An eligible breach of one holder is also an eligible breach of the others. One holder assessment can meet the assessment duty for the others under section 26WJ. If nobody assesses, each holder may be in breach. The scheme does not say which entity must assess. The page expects the arrangement to be agreed when the contract is made. This decision is who assesses. It is not the later decision about who tells the individuals. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Source-by-source verification**

Trace relied-on content to independent sources and check for relevant material the output has missed.

- What the AI does: From the contract, copy which party has possession of the records and which party has a right to deal with them. Leave the assessing party blank.
- What the lawyer does: The lawyer decides who assesses, where more than one entity holds the information. The page says an entity holds personal information if it has possession or control of the record, including a right or power to deal with it without physical possession. An eligible breach of one holder is also an eligible breach of the others. One holder assessment can meet the assessment duty for the others under section 26WJ. If nobody assesses, each holder may be in breach. The scheme does not say which entity must assess. The page expects the arrangement to be agreed when the contract is made. This decision is who assesses. It is not the later decision about who tells the individuals.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.

## Checks the lawyer makes

1. Treat a party with a contractual right to deal with the records as a holder, even if it does not store them.
2. Record one assessing entity. Do not assume a supplier assessment covers the client until that is agreed and done.
3. If no one has assessed, record that each holder may still have the duty.
4. Do not decide in this note who sends the notice to individuals.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [OAIC: Part 4, Notifiable Data Breach scheme](https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-4-notifiable-data-breach-ndb-scheme) (checked 2026-10-22)

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-which-entity-assesses-a-breach-of-shared-information/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*