Notifiable Data Breaches: what to do in the first 72 hours

Under the Privacy Act 1988, organisations covered by the Notifiable Data Breaches (NDB) scheme must notify affected individuals and the Office of the Australian Information Commissioner (OAIC) when an eligible data breach occurs. The first few days after you suspect a breach decide how well that goes. This article sets out a practical 72-hour plan. It is general guidance, not legal advice, and you should involve your lawyer or insurer early.

What counts as an eligible data breach

A breach is eligible when three things are true: there is unauthorised access to, unauthorised disclosure of, or loss of personal information; it is likely to result in serious harm to one or more individuals; and you have not been able to prevent the likely risk of serious harm through remedial action. That third point is important. Fast, effective containment can mean a breach is not notifiable at all.

Hours 0 to 4: contain and preserve

• Open an incident record and note the time the issue was discovered and by whom.
• Assign one incident lead who makes decisions and one person who keeps the log.
• Contain without destroying evidence: disable compromised accounts, revoke exposed keys or tokens, and isolate affected systems rather than wiping them.
• Preserve logs from identity providers, cloud consoles, email and endpoints before retention windows expire.
• Notify your cyber insurer if you have one; many policies require prompt notice and provide incident response panels.

Hours 4 to 24: understand scope

Your goal is a working answer to four questions: what data, whose data, how much, and is it still exposed. Early answers will be incomplete. Write down what you know, what you assume and what you still need to verify.

• Identify the systems and data stores involved and the types of personal information in them.
• Estimate the number of individuals and whether any are particularly vulnerable.
• Check for sensitive information such as health, financial, identity document or tax file number data.
• Confirm whether the access has stopped and whether data was copied out.
• Brief executives with facts and uncertainty, not speculation.

Hours 24 to 72: assess harm and plan communications

The OAIC's guidance suggests considering the kind and sensitivity of the information, any protections such as encryption, who has obtained the information, and the nature of the potential harm, which can include identity theft, financial loss, threats to physical safety, humiliation and damage to reputation or relationships.

• Document your serious-harm assessment and the reasoning behind it.
• Decide whether remedial action has removed the likely risk of serious harm.
• Draft the statement to the OAIC and notices to individuals so they are ready if needed.
• Prepare practical advice for affected people, such as resetting passwords or contacting IDCARE.
• Consider whether to report to the ACSC, police or other regulators and partners.

What a notification must include

A statement to the Commissioner must include your organisation's identity and contact details, a description of the breach, the kinds of information involved, and recommendations about the steps individuals should take. The OAIC provides an online form. You then notify affected individuals directly, or publish the statement if direct notice is not practicable.

After the first 72 hours

Keep the incident log running until closure. Track remediation actions to completion, review why the breach happened, and update your response plan. The quality of your record matters if the OAIC later asks how you assessed the breach. A clear, timestamped timeline of who decided what, and why, is the single most useful artefact you can produce.