---
title: "Decide who is told about an eligible data breach"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-who-is-told-about-an-eligible-data-breach"
type: "task"
site: "AI Law Framework"
id: "A24-SF20261022-13"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Decide who is told about an eligible data breach

> From the assessment, copy the kinds of information, the individuals the assessment says are at risk, and whether the client has a usual way of contacting them. Leave the notification option blank.…

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-who-is-told-about-an-eligible-data-breach  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the assessment, copy the kinds of information, the individuals the assessment says are at risk, and whether the client has a usual way of contacting them. Leave the notification option blank. The tool does not write the statement. |
| What the lawyer must review | The lawyer chooses the notification path and writes the statement. Once there are reasonable grounds to believe there has been an eligible data breach, the entity notifies as soon as practicable. Section 26WK requires a statement with the entity identity and contact details, a description of the breach, the kinds of information, and the steps the entity recommends. Section 26WL gives three options: notify each individual to whom the information relates, notify only the individuals at risk of serious harm, or, if neither is practicable, publish the statement on the website and take reasonable steps to publicise it. The Commissioner generally expects a website statement to stay up for at least six months. A published notice must not include personal information. Where more than one entity holds the information, one notification can meet the duty, and the page suggests the entity with the most direct relationship with the individuals. If none notify, each may be in breach. Individuals are notified of the contents of the statement. The lawyer writes it. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Line-by-line review**

Review the complete output at the level of each line; check facts, meaning and omissions.

- What the AI does: From the assessment, copy the kinds of information, the individuals the assessment says are at risk, and whether the client has a usual way of contacting them. Leave the notification option blank. The tool does not write the statement.
- What the lawyer does: The lawyer chooses the notification path and writes the statement. Once there are reasonable grounds to believe there has been an eligible data breach, the entity notifies as soon as practicable. Section 26WK requires a statement with the entity identity and contact details, a description of the breach, the kinds of information, and the steps the entity recommends. Section 26WL gives three options: notify each individual to whom the information relates, notify only the individuals at risk of serious harm, or, if neither is practicable, publish the statement on the website and take reasonable steps to publicise it. The Commissioner generally expects a website statement to stay up for at least six months. A published notice must not include personal information. Where more than one entity holds the information, one notification can meet the duty, and the page suggests the entity with the most direct relationship with the individuals. If none notify, each may be in breach. Individuals are notified of the contents of the statement. The lawyer writes it.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.

## Checks the lawyer makes

1. Use the publish option only after the lawyer has decided that notifying individuals is not practicable.
2. Include all four contents of section 26WK. A description alone is not the statement.
3. Keep personal information out of a website notice.
4. Where another entity holds the same information, record which entity will notify, so that a second notice is not assumed and a missed notice is not assumed either.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [OAIC: Part 4, Notifiable Data Breach scheme](https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-4-notifiable-data-breach-ndb-scheme) (checked 2026-10-22)

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-who-is-told-about-an-eligible-data-breach/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*