Notice · Privacy, Data Protection & Cyber
Notification of an eligible data breach to affected individuals (Privacy Act s 26WL), with the public-notice option
Plain-language notice to individuals whose information was involved in an eligible data breach, carrying the four matters s 26WK(3) requires, practical steps to reduce harm and support contacts, plus the decision record for choosing direct, at-risk or public notification.
- Kind
- Notice. A formal notice to serve or publish.
- Where it applies
- Australia, Commonwealth
- AI use
- Yellow AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at
- 18 October 2026
- Status
- Maintained. Checked on 18 October 2026 against the 4 authorities it cites, for Australia and Commonwealth.
- Version
- 1
- Source
- Written for this library
When to use it
Use after an entity has decided there are reasonable grounds to believe an eligible data breach has happened and has prepared its statement for the OAIC. The notice repeats the statement’s contents for individuals. Do not use it to decide whether a breach is notifiable; use the data breach response plan and assessment record for that.
Used for these tasks
Each task page says how far AI may help with the task and what the lawyer must review.
How AI may be used
AI may turn the approved OAIC statement into plain-language notices and segment the recipient list by the kinds of information involved; the lawyer and incident lead approve every factual statement and recommendation before anything is sent.
AI may
- Rewrite the approved s 26WK statement in plain language for individuals, without adding facts
- Produce versions of the notice for groups of individuals affected by different kinds of information, from the data mapping the incident team has confirmed
- Check every notice version against the statement for consistency in dates, description and recommended steps
AI must not
- Must not state the cause, the attacker, the number affected or that information has not been misused unless the incident lead has confirmed it
- Must not soften or omit any of the four required matters, or add reassurance the facts do not support
- Must not be given the affected individuals’ data itself beyond what is needed to segment the mailing, and only in an approved environment
The lawyer checks
- The notice contains the entity’s identity and contact details, a description of the breach, the kinds of information involved and recommended steps, consistent with the statement given to the OAIC
- The method chosen (all individuals, those at risk, or publication) is recorded with reasons under s 26WL(2)
- Every factual statement has been confirmed by the incident lead, and nothing in the notice is an admission the entity has not decided to make
- Notices go out as soon as practicable after the statement is prepared, and support channels (hotline, ID support) are live first
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Privacy, Data Protection & Cyber
- Response to a request for access to personal information (APP 12), with refusal notice and correction options (APP 13)
- Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
- Notifiable data breach statement to the OAIC: completion guide for the online form
- APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
- Letter of demand for a serious invasion of privacy (statutory tort, Privacy Act Sch 2): take-down, undertakings and remedies
- Collection notice (APP 5) for forms, websites, apps and call scripts
- Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
- Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
- AI and automated decisions clause for privacy policies and collection notices
- Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)
All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area