---
title: "Notifiable data breach statement to the OAIC: completion guide for the online form"
url: "https://ailawframework.com/precedents/privacy-data-protection-and-cyber/ndb-statement-to-oaic"
type: "precedent"
site: "AI Law Framework"
id: "a25-ndb-statement-to-oaic"
area_id: "A25"
kind: "form"
ai_level: "red"
version: 1
law_stated_as_at: "2026-10-17"
---

# Notifiable data breach statement to the OAIC: completion guide for the online form

> Practical guide to completing the OAIC's online Notifiable Data Breach form: what goes in the mandatory statement (Part one), what to add in the optional Part two, what to attach, and the traps that lead to a…

Canonical page: https://ailawframework.com/precedents/privacy-data-protection-and-cyber/ndb-statement-to-oaic  
Law stated as at: 2026-10-17

Site index for agents: https://ailawframework.com/llms.txt

Practical guide to completing the OAIC's online Notifiable Data Breach form: what goes in the mandatory statement (Part one), what to add in the optional Part two, what to attach, and the traps that lead to a non-compliant statement.

## Key facts

- Kind: Form. A form to complete, or a guide to completing an official one.
- Practice area: [Privacy, Data Protection & Cyber](https://ailawframework.com/precedents/privacy-data-protection-and-cyber.md)
- Jurisdictions: Australia
- AI level: Red. Keep AI out of the decisive steps. A lawyer does the work.
- Law stated as at: 2026-10-17
- Status: Maintained. Checked on 2026-10-17 against the official form at oaic.gov.au and the 5 authorities it cites, for Australia.

## When to use it

Use once the organisation has reasonable grounds to believe an eligible data breach has happened and a lawyer has settled the statement. Do not use it to decide whether a breach is notifiable; use the assessment in the data breach response plan for that.

## How AI may be used

Lawyer-led. AI may only organise the incident record into a sourced table and check a lawyer's draft for missing elements. The privacy officer and lawyer write the statement and the organisation lodges it.

**AI may:**

- Organise the incident log into a table of what was accessed, whose information and which systems, with each row referenced to its source log or document.
- Check a lawyer-written draft against the four matters in s 26WK(3) and flag gaps or differences from the notice to individuals.

**AI must not:**

- Must not write any part of the statement or of the notice to individuals.
- Must not process the incident record in a tool that is not approved for confidential and personal information.
- Must not lodge the form, or decide that an exception (s 26WF, s 26WN or s 26WP) applies.

**The lawyer checks:**

- Part one contains the four required matters and matches the notice to individuals.
- Every fact is confirmed, or labelled as an estimate with its basis.
- Any reliance on an exception is reasoned and recorded in the assessment file.

## Authorities

- [Privacy Act 1988 (Cth) s 26WK (statement about eligible data breach)](https://www.legislation.gov.au/C2004A03712/latest/text)
- [Privacy Act 1988 (Cth) s 26WL (notifying individuals)](https://www.legislation.gov.au/C2004A03712/latest/text)
- [Privacy Act 1988 (Cth) ss 26WN and 26WP (exceptions: enforcement-related activities; secrecy provisions)](https://www.legislation.gov.au/C2004A03712/latest/text)
- [Privacy Act 1988 (Cth) s 13K(2) (civil penalty for a statement that does not comply with s 26WK(3))](https://www.legislation.gov.au/C2004A03712/latest/text)
- [OAIC, Report a data breach (online Notifiable Data Breach form and read-only training version)](https://www.oaic.gov.au/privacy/notifiable-data-breaches/report-a-data-breach)

## Official form

[Official form](https://www.oaic.gov.au/privacy/notifiable-data-breaches/report-a-data-breach)

## Where this comes from

The official form is published by oaic.gov.au; this page is a completion guide. Last checked on 2026-10-17.

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/privacy-data-protection-and-cyber/ndb-statement-to-oaic and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*