Policy · Privacy, Data Protection & Cyber
Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
A ready-to-tailor plan that tells the response team how to contain, assess, notify and review a data breach under Part IIIC of the Privacy Act, and lists the other reporting clocks that may run at the same time.
- Kind
- Policy. A policy or procedure for a firm or client.
- Where it applies
- Australia, New Zealand, European Union, United Kingdom (England and Wales)
- AI use
- Yellow AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at
- 17 October 2026
- Status
- Maintained. Checked against the cited sources on 17 October 2026.
- Version
- 1
- Source
- Written for this library
When to use it
Use to give a client (or your own practice) a written plan before an incident, and as the playbook during one. Do not use it as the notification itself: the statement to the OAIC and the notices to individuals are separate documents settled by a lawyer.
How AI may be used
AI may help draft and test the plan and, during an incident, organise tickets and logs into a sourced chronology inside an approved tool. People decide containment, serious harm, ransom questions and notification.
AI may
- Draft the plan from the organisation's real roles, systems, insurer conditions and contracts, for legal review.
- Generate tabletop scenarios (including a breach caused by an AI tool or a vendor) and compare the team's answers with the plan.
- In a tool approved for confidential data, turn incident tickets and emails into a chronology where every line cites its source.
AI must not
- Must not receive live breach data, logs, ransom communications or affected individuals' details in a tool that is not approved for confidential and personal information.
- Must not decide whether a breach is likely to result in serious harm, or whether remedial action has removed that risk.
- Must not send, lodge or publish any statement, notice or media response.
The lawyer checks
- Each reporting clock in clause 6.5 has been checked against current law, the client's sector and its contracts.
- The serious-harm conclusion in Schedule 2 is reasoned, dated and signed by the decision-maker.
- The roles, phone numbers and insurer conditions in Schedule 3 are current and work when email is down.
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Official form
Open the official form. Always use the current version from the issuer.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Privacy, Data Protection & Cyber
- Notifiable data breach statement to the OAIC: completion guide for the online form
- APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
- Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
- Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
- AI and automated decisions clause for privacy policies and collection notices
- Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)
All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area