CyberStack

Knowledge / IR au-compliance acsc-glossary

Data breach

Data lost, peeked, changed, or leaked without authorisation. In Australia the NDB clock may also be running.

PRIVACY ACT / NDB SCHEMEHold dataAPP 11Assess30 daysNotifyOAIC + peopleEligible breach: unauthorised access/disclosure likely to cause serious harm.

A data breach is unauthorised access, disclosure, loss, change, or other misuse of data — ACSC also uses 'data spill'. It does not require a hoodie. An email to the wrong trustee is still a breach.

Contain, work out what left, and whether personal information is involved. Eligible breaches under the Notifiable Data Breaches scheme need assessment and, if the harm test is met, notice to people and the OAIC.

Prevention is the usual choir: least privilege, encryption, logging, MFA, suppliers on a leash. The glossary will not save a missing backup of the investigation notes.

Fact source: ASD's ACSC glossary.