--- title: "Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)" url: "https://ailawframework.com/precedents/privacy-data-protection-and-cyber/data-breach-response-plan" type: "precedent" site: "AI Law Framework" id: "a25-data-breach-response-plan" area_id: "A25" kind: "policy" ai_level: "yellow" version: 1 law_stated_as_at: "2026-10-17" --- # Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks) > A ready-to-tailor plan that tells the response team how to contain, assess, notify and review a data breach under Part IIIC of the Privacy Act, and lists the other reporting clocks that may run at the same time. Canonical page: https://ailawframework.com/precedents/privacy-data-protection-and-cyber/data-breach-response-plan Law stated as at: 2026-10-17 Site index for agents: https://ailawframework.com/llms.txt ## Key facts - Kind: Policy. A policy or procedure for a firm or client. - Practice area: [Privacy, Data Protection & Cyber](https://ailawframework.com/precedents/privacy-data-protection-and-cyber.md) - Jurisdictions: Australia, New Zealand, European Union, United Kingdom (England and Wales) - AI level: Yellow. AI can help in set ways. A lawyer checks specific points before use. - Law stated as at: 2026-10-17 - Status: Maintained. Checked on 2026-10-17 against the 14 authorities it cites, for 4 jurisdictions. ## When to use it Use to give a client (or your own practice) a written plan before an incident, and as the playbook during one. Do not use it as the notification itself: the statement to the OAIC and the notices to individuals are separate documents settled by a lawyer. ## How AI may be used AI may help draft and test the plan and, during an incident, organise tickets and logs into a sourced chronology inside an approved tool. People decide containment, serious harm, ransom questions and notification. **AI may:** - Draft the plan from the organisation's real roles, systems, insurer conditions and contracts, for legal review. - Generate tabletop scenarios (including a breach caused by an AI tool or a vendor) and compare the team's answers with the plan. - In a tool approved for confidential data, turn incident tickets and emails into a chronology where every line cites its source. **AI must not:** - Must not receive live breach data, logs, ransom communications or affected individuals' details in a tool that is not approved for confidential and personal information. - Must not decide whether a breach is likely to result in serious harm, or whether remedial action has removed that risk. - Must not send, lodge or publish any statement, notice or media response. **The lawyer checks:** - Each reporting clock in clause 6.5 has been checked against current law, the client's sector and its contracts. - The serious-harm conclusion in Schedule 2 is reasoned, dated and signed by the decision-maker. - The roles, phone numbers and insurer conditions in Schedule 3 are current and work when email is down. ## Authorities - [Privacy Act 1988 (Cth) Pt IIIC (notification of eligible data breaches)](https://www.legislation.gov.au/C2004A03712/latest/text) - [Privacy Act 1988 (Cth) s 26WE (eligible data breach)](https://www.legislation.gov.au/C2004A03712/latest/text) - [Privacy Act 1988 (Cth) s 26WF (exception for remedial action)](https://www.legislation.gov.au/C2004A03712/latest/text) - [Privacy Act 1988 (Cth) s 26WG (matters relevant to serious harm)](https://www.legislation.gov.au/C2004A03712/latest/text) - [Privacy Act 1988 (Cth) s 26WH (assessment of suspected breach within 30 days)](https://www.legislation.gov.au/C2004A03712/latest/text) - [Privacy Act 1988 (Cth) ss 26WK and 26WL (statement to the Commissioner; notifying individuals)](https://www.legislation.gov.au/C2004A03712/latest/text) - [Privacy Act 1988 (Cth) s 13K(2) (civil penalty for a non-compliant statement)](https://www.legislation.gov.au/C2004A03712/latest/text) - [Privacy Act 1988 (Cth) Sch 1 APP 11 (security of personal information)](https://www.legislation.gov.au/C2004A03712/latest/text) - [Cyber Security Act 2024 (Cth) s 27 (ransomware payment report within 72 hours)](https://www.legislation.gov.au/C2024A00098/latest/text) - [Australian Signals Directorate, Ransomware payment and cyber extortion payment reporting (official form)](https://www.cyber.gov.au/ransomware-payment-and-cyber-extortion-payment-reporting) - [Security of Critical Infrastructure Act 2018 (Cth) ss 30BC and 30BD (cyber incident reports within 12 or 72 hours)](https://www.legislation.gov.au/C2018A00029/latest/text) - [Privacy Act 2020 (NZ) ss 114 and 115 (notifiable privacy breaches)](https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23223.html) - [Regulation (EU) 2016/679 (GDPR) arts 33 and 34](https://eur-lex.europa.eu/eli/reg/2016/679/oj) - [UK GDPR arts 33 and 34](https://www.legislation.gov.uk/eur/2016/679/contents) ## Official form [Official form](https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-2-preparing-a-data-breach-response-plan) ## Full text and drafting notes The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/privacy-data-protection-and-cyber/data-breach-response-plan and through the signed-in MCP connector https://ailawframework.com/mcp/firm. *Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*