Quick reference guide for responding to data breaches

Has the personal information your entity holds been subject to unauthorised access, unauthorised disclosure, or loss?

For example:

• an employee browsing sensitive customer records without any legitimate purpose
• a computer network being compromised by an external attacker resulting in personal information being accessed without authority
• an employee of your entity accidentally publishing a confidential data file containing the personal information of one or more individuals on the internet
• an employee of your entity leaves personal information (including hard copy documents, unsecured computer equipment, or portable storage devices containing personal information) on public transport.

The NDB scheme requires notification of eligible data breaches. A data breach is ‘eligible’ if it is likely to result in serious harm to one or more individuals and your entity has not been able to prevent the likely risk of serious harm with remedial action.

Is the data breach likely to result in serious harm to any of the individuals whose personal information was involved?

Assess this from the perspective of a ‘reasonable person’. A ‘reasonable person’ means a person in your entity’s position (rather than the position of an individual whose personal information was part of the data breach or any other person), who is properly informed, based on information immediately available or following reasonable inquiries or an assessment of the data breach.

‘Serious harm’ to an individual may include serious physical, psychological, emotional, financial, or reputational harm.

Serious harm is ‘likely’ to occur if the risk of serious harm to an individual is more probable than not (rather than possible). Assess the risk of serious harm holistically, having regard to the likelihood of the harm eventuating for individuals whose personal information was part of the data breach and the consequences of the harm. The NDB scheme includes a non-exhaustive list of ‘relevant matters’ that may assist you to assess the likelihood of serious harm. These are listed under ‘Is serious harm likely?’ in Identifying eligible data breaches.

Has your entity been able to prevent the likely risk of serious harm through remedial action?

If your entity takes remedial action such that the data breach would not be likely to result in serious harm, then the breach is not an eligible data breach. For breaches where information is lost, the remedial action is adequate if it prevents unauthorised access to, or disclosure of personal information.

If the remedial action prevents the likelihood of serious harm to some individuals within a larger group of individuals whose information was compromised in a data breach, notification to those individuals for whom harm has been prevented is not required.

Because your entity has experienced an eligible data breach and has not been able to mitigate the likelihood of serious harm, your entity must notify individuals at risk of serious harm and provide a statement to the OAIC as soon as practicable, unless an exception applies.

The exceptions to the notification obligations relate to:

• eligible data breaches of other entities (explained in final paragraph below)
• enforcement related activities
• inconsistency with secrecy provisions
• declarations by the OAIC.

In addition, if you have notified (or are required to notify) the OAIC and the My Health Record System Operator of a data breach under s 75 of the My Health Records Act, you are not required to separately notify under the NDB scheme.

If the eligible data breach applies to multiple entities, only one entity needs to notify the OAIC and individuals at risk of serious harm. It is up to you and the other entity/entities to decide who notifies. Generally, the entity with the most direct relationship with the individuals at risk of serious harm should undertake the notification. If it is decided that your entity will undertake the notification, proceed to the next step.

Because your entity has experienced an eligible data breach, and has not been able to mitigate the likelihood of serious harm, your entity must notify individuals at risk of serious harm and provide a statement to the OAIC as soon as practicable.

How to notify the OAIC

To notify the OAIC of your eligible data breach, use the OAIC’s Notifiable Data Breach form. To see the type of information the OAIC needs, view the read only training version (PDF, 228KB).

How to notify individuals

There are three options for notifying individuals at risk of serious harm, depending on what is ‘practicable’ for your entity. These options (and what information to include, and what communications method to use) are outlined in Assessing a suspected data breach under ‘Who needs to be notified?’.

The OAIC expects practical steps to be provided to affected individuals based on the kinds of information involved in the data breach. As part of this your entity may wish to refer affected individuals to the OAIC’s practical guidance on how to reduce their risk of harm, the OAIC’s list of Data breach support and resources, and/or the Act quickly if you’re affected by a data breach poster.

Notifications to affected individuals should be written in plain English so they are clear and easy to understand. Avoid complex terms or technical jargon.