---
title: "Notification of an eligible data breach to affected individuals (Privacy Act s 26WL), with the public-notice option"
url: "https://ailawframework.com/precedents/privacy-data-protection-and-cyber/eligible-data-breach-notification-to-individuals"
type: "precedent"
site: "AI Law Framework"
id: "a25-eligible-data-breach-notification-to-individuals"
area_id: "A25"
kind: "notice"
ai_level: "yellow"
version: 1
task_ids: ["A25-T1-R3", "A25-B15-1"]
law_stated_as_at: "2026-10-18"
---

# Notification of an eligible data breach to affected individuals (Privacy Act s 26WL), with the public-notice option

> Plain-language notice to individuals whose information was involved in an eligible data breach, carrying the four matters s 26WK(3) requires, practical steps to reduce harm and support contacts, plus the decision…

Canonical page: https://ailawframework.com/precedents/privacy-data-protection-and-cyber/eligible-data-breach-notification-to-individuals  
Law stated as at: 2026-10-18

Site index for agents: https://ailawframework.com/llms.txt

Plain-language notice to individuals whose information was involved in an eligible data breach, carrying the four matters s 26WK(3) requires, practical steps to reduce harm and support contacts, plus the decision record for choosing direct, at-risk or public notification.

## Key facts

- Kind: Notice. A formal notice to serve or publish.
- Practice area: [Privacy, Data Protection & Cyber](https://ailawframework.com/precedents/privacy-data-protection-and-cyber.md)
- Jurisdictions: Australia, Commonwealth
- AI level: Yellow. AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at: 2026-10-18
- Status: Maintained. Checked on 2026-10-18 against the 4 authorities it cites, for Australia and Commonwealth.

## When to use it

Use after an entity has decided there are reasonable grounds to believe an eligible data breach has happened and has prepared its statement for the OAIC. The notice repeats the statement’s contents for individuals. Do not use it to decide whether a breach is notifiable; use the data breach response plan and assessment record for that.

## Used for these tasks

- [Assess a suspected data breach and draft the notification pack](https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack.md)
- [Draft the statement to the OAIC about a notifiable data breach from the incident log](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md#A25-B15-1)

## How AI may be used

AI may turn the approved OAIC statement into plain-language notices and segment the recipient list by the kinds of information involved; the lawyer and incident lead approve every factual statement and recommendation before anything is sent.

**AI may:**

- Rewrite the approved s 26WK statement in plain language for individuals, without adding facts
- Produce versions of the notice for groups of individuals affected by different kinds of information, from the data mapping the incident team has confirmed
- Check every notice version against the statement for consistency in dates, description and recommended steps

**AI must not:**

- Must not state the cause, the attacker, the number affected or that information has not been misused unless the incident lead has confirmed it
- Must not soften or omit any of the four required matters, or add reassurance the facts do not support
- Must not be given the affected individuals’ data itself beyond what is needed to segment the mailing, and only in an approved environment

**The lawyer checks:**

- The notice contains the entity’s identity and contact details, a description of the breach, the kinds of information involved and recommended steps, consistent with the statement given to the OAIC
- The method chosen (all individuals, those at risk, or publication) is recorded with reasons under s 26WL(2)
- Every factual statement has been confirmed by the incident lead, and nothing in the notice is an admission the entity has not decided to make
- Notices go out as soon as practicable after the statement is prepared, and support channels (hotline, ID support) are live first

## Authorities

- [Privacy Act 1988 (Cth) s 26WK (statement about an eligible data breach: identity and contact details, description, kinds of information, recommended steps)](https://www.legislation.gov.au/C2004A03712/latest/text)
- [Privacy Act 1988 (Cth) s 26WL (notify each individual, or each individual at risk, or publish on the website and publicise; as soon as practicable; usual method of communication)](https://www.legislation.gov.au/C2004A03712/latest/text)
- [Privacy Act 1988 (Cth) ss 26WH and 26WF (30-day assessment of a suspected breach; exception for remedial action)](https://www.legislation.gov.au/C2004A03712/latest/text)
- [Privacy Act 1988 (Cth) s 26WM (one notification can cover a breach of several entities)](https://www.legislation.gov.au/C2004A03712/latest/text)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/privacy-data-protection-and-cyber/eligible-data-breach-notification-to-individuals and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*