Data breach response plan

The OAIC's Data breach preparation and response guide treats a data breach response plan as preparation, not paperwork after the fact. Part 2 (Preparing a data breach response plan — updated February 2025) sits beside Part 3 (contain, assess, notify, review) and Part 4 (the Notifiable Data Breaches scheme). If you are an APP entity, the plan is how you meet the assessment and notify clocks without inventing a process under pressure.

OAIC's key points for Part 2: a quick response based on an up-to-date plan is critical; the plan should outline your strategy for containing, assessing and managing the incident from start to finish; and Part 2 is the practical build guide. Under the Privacy Act, taking reasonable steps to protect personal information you hold includes being able to reduce the impact of a breach — a written, tested response plan is one of those steps. Speed also limits harm to individuals and financial or reputational damage to the entity, and preserves public trust.

A usable plan names who owns the response (privacy, legal, IT/security, communications, executive), how to escalate after hours, and how to reach the OAIC form and any sector regulator. It gives a clear explanation of what counts as a data breach for your staff, with examples tailored to your business. It lists systems that hold personal information, including vendors. It says how you contain (isolate accounts, revoke tokens, preserve logs) without destroying evidence. It points at the serious-harm test and the NDB statement, not a generic 'we take privacy seriously' paragraph.

OAIC expects the plan to cover: a strategy for containing, assessing and managing breaches (including capability to act as a priority); legislative or contractual duties (NDB if you are in); a clear immediate communications strategy — who notifies individuals, when (eligible-breach test), how they are contacted, which external stakeholders (law enforcement, cyber agencies, OAIC, media) and who liaises; staff roles — who is told first, when a line manager can handle it versus when it escalates to the response team (volume affected, risk of serious harm, systemic issues, reputational risk); documentation of incidents including those not escalated; and a post-breach review of both the cause and the plan's effectiveness.

Response-team membership must be named before the breach. OAIC: keep a current list of members, roles, authorities and contact details (attach it to the plan). Core team plus surge skills (legal, forensics, media) on short notice. Regularly review and test — for example with a hypothetical breach — and retune when you introduce new products, services or systems that handle personal information. How often you test depends on size, operations, sensitivity of the information, and the harm a breach could cause.

Part 3's four steps are the runtime: contain the breach; assess the risks (including whether it is an eligible data breach); notify the OAIC and individuals when required; review and improve. The plan should say which step starts which clock. Thirty days is for assessing a suspicion under s 26WH(2). Notification, once you have reasonable grounds that the breach is eligible, is as soon as practicable. Remedial action that removes the likelihood of serious harm can change the notification duty — document that reasoning.

Third-party and cloud breaches still need your plan. If a provider holds or processes personal information for you, your assessment clock can start when you have grounds to suspect, not when their status page turns green. Put vendor contacts, shared-responsibility splits, and evidence requests in the plan. Pair this page with the NDB clock, the serious-harm test, and the NDB statement pages. Keep the plan short enough to open in an incident bridge; attach the OAIC quick reference, the personal-information map, and the last tabletop date.