Form · Privacy, Data Protection & Cyber
Notifiable data breach statement to the OAIC: completion guide for the online form
Practical guide to completing the OAIC's online Notifiable Data Breach form: what goes in the mandatory statement (Part one), what to add in the optional Part two, what to attach, and the traps that lead to a non-compliant statement.
- Kind
- Form. A form to complete, or a guide to completing an official one.
- Where it applies
- Australia
- AI use
- Red Keep AI out of the decisive steps. A lawyer does the work.
- Law stated as at
- 17 October 2026
- Status
- Maintained. Checked on 17 October 2026 against the official form at oaic.gov.au and the 5 authorities it cites, for Australia.
- Version
- 1
- Source
- Link to the official form. Licence: CC BY 4.0 (OAIC website; logo, Coat of Arms and third-party content excepted). Official online form: link only, not reproduced.
Where this comes from
The official form is published by oaic.gov.au; this page is a completion guide. Last checked on 2026-10-17.
When to use it
Use once the organisation has reasonable grounds to believe an eligible data breach has happened and a lawyer has settled the statement. Do not use it to decide whether a breach is notifiable; use the assessment in the data breach response plan for that.
How AI may be used
Lawyer-led. AI may only organise the incident record into a sourced table and check a lawyer's draft for missing elements. The privacy officer and lawyer write the statement and the organisation lodges it.
AI may
- Organise the incident log into a table of what was accessed, whose information and which systems, with each row referenced to its source log or document.
- Check a lawyer-written draft against the four matters in s 26WK(3) and flag gaps or differences from the notice to individuals.
AI must not
- Must not write any part of the statement or of the notice to individuals.
- Must not process the incident record in a tool that is not approved for confidential and personal information.
- Must not lodge the form, or decide that an exception (s 26WF, s 26WN or s 26WP) applies.
The lawyer checks
- Part one contains the four required matters and matches the notice to individuals.
- Every fact is confirmed, or labelled as an estimate with its basis.
- Any reliance on an exception is reasoned and recorded in the assessment file.
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Official form
Open the official form. Always use the current version from the issuer. Licence: CC BY 4.0 (OAIC website; logo, Coat of Arms and third-party content excepted). Official online form: link only, not reproduced..
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Privacy, Data Protection & Cyber
- Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
- APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
- Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
- Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
- AI and automated decisions clause for privacy policies and collection notices
- Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)
All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area