---
title: "Eligible data breach assessment record"
url: "https://ailawframework.com/precedents/health-and-medical-law/eligible-data-breach-assessment"
type: "precedent"
site: "AI Law Framework"
id: "a32-eligible-data-breach-assessment"
area_id: "A32"
kind: "form"
ai_level: "red"
version: 1
task_ids: ["A32-R20261018-4"]
law_stated_as_at: "2026-10-22"
---

# Eligible data breach assessment record

> Record for deciding whether a loss of, or unauthorised access to, personal information is an eligible data breach that must be notified. The officer makes the decision.

Canonical page: https://ailawframework.com/precedents/health-and-medical-law/eligible-data-breach-assessment  
Law stated as at: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

- Kind: Form. A form to complete, or a guide to completing an official one.
- Practice area: [Health & Medical Law](https://ailawframework.com/precedents/health-and-medical-law.md)
- Jurisdictions: Commonwealth
- AI level: Red. You write the text. The tool writes nothing into the document. Where permitted, it may check, clarify or collect data, and anything it checks or collects is verified.
- Law stated as at: 2026-10-22
- Status: Maintained. Checked on 2026-10-22 against the authority it cites, for Commonwealth.

## When to use it

Use when a health service or other APP entity suspects personal information it holds has been lost or accessed or disclosed without authority, including health information.

## Used for these tasks

- [Assess a suspected data breach of patient information and decide whether to notify](https://ailawframework.com/practice/health-and-medical-law/assess-a-suspected-data-breach-of-patient-information-and-decide-whether.md)

## How AI may be used

The tool lists systems, dates and document titles from the incident log, and it does not decide serious harm or draft the statement to the Commissioner or to patients.

**AI may:**

- Enter the date the entity became aware of the grounds for suspicion, from the incident log.
- List the kinds of information involved, using the labels in the log, including whether health information is included.
- Calculate the date 30 calendar days after that awareness date, for the officer to check.

**AI must not:**

- Do not decide that serious harm is likely, or that remedial action has prevented it.
- Do not draft the statement to the Commissioner or the notice to individuals.
- Do not put patient information into a public tool.

**The lawyer checks:**

- Apply the three criteria on the OAIC page, from the viewpoint of a reasonable person in the entity's position.
- Section 26WH(2), as the OAIC states it: the assessment must be reasonable and expeditious, and all reasonable steps must be taken to complete it within 30 calendar days.
- Notify the Commissioner and individuals as soon as practicable only if the officer believes there has been an eligible data breach. State privacy laws were not opened.

## Authorities

- [OAIC, Part 4: Notifiable Data Breach (NDB) scheme](https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-4-notifiable-data-breach-ndb-scheme)

## Official form

[Official form](https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-4-notifiable-data-breach-ndb-scheme)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/health-and-medical-law/eligible-data-breach-assessment and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*