Free template · Word download · Notifiable Data Breaches
Data Breach Response Plan
Template (Australia)
A free data breach response plan for Australian organisations covered by the Privacy Act, to
copy or download as Word with no sign-up. It follows the OAIC's four steps and the Notifiable
Data Breaches scheme: assess a suspected breach within 30 days, then notify the Commissioner
and the people affected as soon as practicable. Below it, a guide to every section, with real
wording for the 3 clauses people get wrong.
Rather not fill it in yourself? Have
your plan generated in your branding instead - the signup
credits cover the first one. Card required to download that one; no charge today.
Generated from this page's structure, in an example company's branding
Free template
Free Australian data breach response plan template
The complete data breach response plan, free to copy from this page or download as an editable Word document.
No sign-up. Replace every [bracketed placeholder] with your own details, delete anything that
does not apply, and have it approved before you rely on it. The guide below
explains what each section has to contain and what an auditor checks.
A data breach response plan for Australian organisations covered by the Privacy Act 1988, built around the OAIC's four steps and the Notifiable Data Breaches scheme. Replace the bracketed placeholders with your own details.
This plan sets out how [Organisation] responds when personal information it holds may have been accessed or disclosed without authorisation, or lost. Everyone who works for [Organisation] should know where to find it and what to do in the first hour.
1. Purpose and scope
This plan covers every data breach involving personal information [Organisation] holds, including information held for us by service providers such as [our IT provider and cloud services]. It applies to all staff, contractors and volunteers.
It works alongside [our cyber security incident response plan]. When an incident involves personal information, the response team follows this plan as well.
2. What counts as a data breach
A data breach happens when personal information we hold is accessed or disclosed without authorisation, or is lost. For example: [an email with customer details sent to the wrong person], [a lost laptop or phone], or [a cyber attack on one of our systems].
An eligible data breach is one a reasonable person would conclude is likely to result in serious harm to any of the people the information is about. If information is lost, it is one only where unauthorised access to or disclosure of it is likely; we then assume that happens and judge the harm on that basis. Unless remedial action means serious harm is no longer likely, an eligible data breach must be notified to the Australian Information Commissioner and to the people affected.
If you are not sure whether something is a data breach, report it.
3. The response team
The team lead decides who is involved in each breach and can call on outside help: [our IT provider], [our legal advisers] and [our cyber insurer, if we have one].
When [the response team lead] is away or cannot be reached, [name and role, e.g. the Operations Manager] stands in, including for decisions on notification.
Role
Who
Responsibilities
Response team lead
[name and role, e.g. Managing Director]
Leads the response, decides whether to notify, and reports to [senior management]
Privacy officer
[name and role, e.g. Office Manager]
Advises on the Privacy Act, keeps the records and prepares notifications
IT and security
[name, role or provider, e.g. our IT provider]
Contains the breach, preserves evidence and works out what was affected
Communications
[name and role, e.g. Marketing Manager]
Prepares messages to the people affected and anyone else who needs to know
Legal
[internal or external adviser, e.g. our lawyers]
Advises on legal obligations
4. Reporting a suspected breach
Tell [the response team lead] straight away by [phone number or channel], including outside business hours. If they cannot be reached, tell [the deputy] by [phone number or channel]
Say what happened, when you noticed and what information may be involved
Do not investigate it yourself, and do not delete anything
The team lead records the report and decides whether to bring the response team together
5. Step 1: Contain
Containment matters for the law as well as for the people affected. If remedial action means serious harm is no longer likely, the breach does not have to be notified.
Stop the unauthorised access or disclosure: [change passwords, disconnect affected devices, remove access]
Recover what you can: recall the email, ask an unintended recipient to delete it and confirm they have, retrieve a lost device or, where you can, wipe it remotely
Preserve evidence: do not wipe devices or delete logs before IT has captured what it needs
Record every action and when it was taken
6. Step 2: Assess
If there are reasonable grounds to suspect there may have been an eligible data breach, we must carry out a reasonable and expeditious assessment of whether it is one, and take all reasonable steps to complete that assessment within 30 days of becoming aware of the suspicion.
Gather the facts: what happened, what information was involved, whose, how many people, and who has it or could get it
Judge whether serious harm is likely, considering the kind and sensitivity of the information, whether it was protected (for example encrypted), who has it and the harm that could follow
Record the decision, the reasons and who made it: [the response team lead]
If another organisation holds the same information, agree with it who will assess the breach; one assessment can cover both
7. Step 3: Notify
If there are reasonable grounds to believe an eligible data breach has happened, we must prepare a statement and give a copy to the Australian Information Commissioner as soon as practicable. The statement sets out our identity and contact details, a description of the breach, the kinds of information involved, and the steps we recommend the people affected take.
As soon as practicable after preparing the statement, we tell the people affected: either everyone whose information was involved, or only those at risk of serious harm. If neither is practicable, we publish the statement on our website and take reasonable steps to publicise it. We can use the channel we normally use with each person, such as email.
[The response team lead] approves every notification before it is sent. If another organisation holds the same information and gives the statement, we do not have to give one as well. If the Commissioner directs us to notify, we follow the direction. The team lead decides whether anyone else should be told, such as [our insurer, the police or our bank].
8. Step 4: Review
Work out what caused the breach and how well the response worked
Decide what changes will stop it happening again, each with an owner and a due date
Report the review to [senior management] and keep it with the breach record
9. Records, testing and review of this plan
Record every data breach and suspected breach in [our data breach register], including the assessment, the decision and whether we notified
Test this plan [once a year] with a practice scenario
Review this plan [at least once a year] and after any significant breach. Owner: [role]
This template is a starting point, not legal advice. Replace every bracketed placeholder, delete what does not apply, and have it approved before you rely on it.
The writing guide
How to write a data breach response plan
9
sections
3
with real wording
6
questions you will be asked
4
failure modes
half a day
to write it yourself
A data breach response plan sets out who does what when personal information your organisation
holds is accessed or disclosed without authorisation, or lost. It covers the four steps the OAIC
describes: contain the breach, assess it, notify the Commissioner and the people affected when the
Notifiable Data Breaches scheme requires it, and review what happened.
Write all 9 sections before you need them. The scheme's deadlines are short, and the
OAIC's guide says the team, their roles and the steps should be settled in advance, so the response
is not delayed working them out.
1
Purpose and scope
What it must contain
What the plan covers: every breach of personal information you hold, including information your service providers hold for you, and how it works with your cyber security incident response plan.
What the OAIC and your board look for
That it covers information held by others for you. The OAIC's guide is clear that a cloud provider and its customer can both hold the same records, and both then have obligations.
2
What counts as a data breach
What it must contain
The difference between a data breach (unauthorised access, unauthorised disclosure or loss) and an eligible data breach (one likely to result in serious harm), with examples that fit your business.
What the OAIC and your board look for
Whether staff can recognise one. A plan that only describes cyber attacks misses the most common breach of all: an email sent to the wrong person.
3
The response team
What it must contain
Who leads, who decides whether to notify, who handles IT, communications and legal advice, and which outside experts you can call.
What the OAIC and your board look for
Names, not job families. The OAIC's guide asks for the team, their roles and their reporting lines to be settled before a breach, so the response is not delayed working them out.
4
Reporting a suspected breach
What it must contain
Exactly who staff tell, how, and that they tell them straight away, including outside business hours.
What the OAIC and your board look for
A real channel. The 30 days for assessment run from when you become aware of the suspicion, so a breach sitting in someone's inbox is time lost.
5
Step 1: Contain
What it must contain
How you stop the access or disclosure, recover what you can, and preserve evidence.
What the OAIC and your board look for
That containment is tied to the law. Remedial action can mean serious harm is no longer likely, and then the breach does not have to be notified.
Wording that works
Containment matters for the law as well as for the people affected. If remedial action means serious harm is no longer likely, the breach does not have to be notified.
It tells the team why speed matters beyond good practice: fast remedial action can change the legal outcome, not just reduce the damage.
6
Step 2: Assess
What it must contain
The assessment the law requires when you suspect an eligible data breach, the 30-day limit, and how you judge whether serious harm is likely.
What the OAIC and your board look for
The two timing rules together: reasonable and expeditious, and all reasonable steps to finish within 30 days. Thirty days is the outer limit, not a waiting period.
Wording that works
If there are reasonable grounds to suspect there may have been an eligible data breach, we must carry out a reasonable and expeditious assessment of whether it is one, and take all reasonable steps to complete that assessment within 30 days of becoming aware of the suspicion.
It states both halves of section 26WH, so nobody reads the 30 days as time they are allowed to take.
7
Step 3: Notify
What it must contain
The statement to the Commissioner and what it must contain, the three ways to notify individuals, who approves notifications, and breaches shared with another organisation.
What the OAIC and your board look for
That nothing the law requires is missing from the statement, and that the timing is right: as soon as practicable, with no fixed number of hours or days.
Wording that works
If there are reasonable grounds to believe an eligible data breach has happened, we must prepare a statement and give a copy to the Australian Information Commissioner as soon as practicable. The statement sets out our identity and contact details, a description of the breach, the kinds of information involved, and the steps we recommend the people affected take.
It lists the four things section 26WK(3) requires, in plain words, so the statement can be drafted from the plan under pressure.
8
Step 4: Review
What it must contain
What caused the breach, how the response went, and the changes that stop it happening again, each with an owner.
What the OAIC and your board look for
That reviews happen for every breach, not only the notifiable ones. The small ones show where the next big one will come from.
9
Records, testing and review of this plan
What it must contain
A record of every breach and suspected breach, how often the plan is tested, and when it is reviewed.
What the OAIC and your board look for
The breach register. If you decide a breach was not notifiable, the record of why is your answer when someone asks later.
The Notifiable Data Breaches scheme has no 72-hour rule. If you suspect an eligible data breach,
section 26WH of the Privacy Act requires a reasonable and expeditious assessment, with all
reasonable steps taken to finish it within 30 days of becoming aware. Once there are reasonable
grounds to believe it is an eligible data breach, sections 26WK and 26WL require a statement to the
Commissioner and notice to the people affected as soon as practicable.
Seventy-two hours is a real Australian deadline, but for a different report: a ransomware or cyber
extortion payment under the Cyber Security Act 2024. If an attack ends in a payment, both can apply.
See the free
ransomware payment reporting procedure.
After a breach
What the OAIC, your insurer and your board will ask
After a breach, the questions are about what you knew, when, and what you did. Each of these is
answered by a record the plan makes you keep.
?
When did you become aware of the breach, and when did you finish the assessment?
Satisfies
A dated record showing when the suspicion arose and when the assessment was completed, within 30 days.
Fails
No record of when the clock started.
?
Why did you decide serious harm was, or was not, likely?
Satisfies
The assessment: the information involved, its sensitivity and protection, who had it, and the reasoning.
Fails
"It didn't seem serious," with nothing written down.
?
What did you tell the Commissioner, and when?
Satisfies
A copy of the statement, with every item the law requires, and when it was lodged.
Fails
A statement missing the steps people should take.
?
How did you notify the people affected?
Satisfies
Which option you used (everyone, those at risk, or publication) and how each person was contacted.
Fails
A website notice when contacting people directly was practicable.
?
Who else holds this information, and who notified?
Satisfies
The other organisations involved, and the agreement about which of you assessed and notified.
Fails
Each organisation assumed the other would do it.
?
When did you last test the plan?
Satisfies
A dated practice run and the changes it led to.
Fails
A plan nobody has opened since it was written.
What goes wrong
Where data breach plans go wrong
!
Writing in a 72-hour deadline
The Notifiable Data Breaches scheme has none. You must assess a suspected breach reasonably and expeditiously, taking all reasonable steps to finish within 30 days, then notify as soon as practicable once you have reasonable grounds to believe it is eligible. Seventy-two hours comes from Europe's GDPR, and in Australia from the separate ransomware payment report. A plan with the wrong clock sends the team chasing the wrong deadline.
!
Treating the 30 days as a waiting period
The assessment must be reasonable and expeditious; 30 days is the outer limit. And once you have reasonable grounds to believe a breach is eligible, the duty to notify starts then, not at day 30.
!
Notifying everything, or nothing
Not every breach is notifiable: only one likely to result in serious harm, and remedial action can take a breach out of the scheme. But deciding a breach was not notifiable without recording why leaves you no answer when someone asks.
!
Forgetting the information others hold for you
Your cloud provider, payroll service or IT provider may hold the same records. The law lets one organisation assess and notify for everyone, but if none of you does, all of you may be in breach. The plan should say who does it.
The rest of your privacy documents
Where the plan fits
The plan is the inside of your privacy compliance; your
privacy policy is the outside. When a breach
involves a cyber attack, the plan runs alongside your
incident response plan, which handles
the technical response while this one handles the people whose information was involved.
The guide's statements of the law come from Part IIIC of the Privacy Act 1988 and the OAIC's
"Data breach preparation and response" guide. Both are published for reuse; PolicyMint's plan is
grounded in the same text.
See the real output
What PolicyMint generates
The same nine sections, written for your organisation: your response team and reporting channel,
containment steps for your systems, the assessment and notification rules exactly as the law states
them, and the outside help you really have. It carries your branding and exports to Word, PDF or
Excel. The cover in the hero and the page below are that output, generated for an example company.
One page of the generated document, for an example company. The trial produces the whole
document, not a sample.
Where the guide says [role] or [system], the document says yours; where PolicyMint
cannot know a fact, it asks rather than guesses.
Guided reviewActual product
The one fact this document could not know stays highlighted in the document and the
export. The review explains what is needed and writes your answer in. Nothing is
invented. Fictional demo data.
Side by side
Writing it yourself vs generating it
Scroll the table sideways to compare both routes.
Dimension
Writing it yourself
Generating it with PolicyMint
The structure
This page: nine sections, the OAIC's four steps, free.
The same nine sections, filled in from your business profile and answers.
The law
You check every timing rule and statement item against the Act.
Grounded in Part IIIC and the OAIC's guide, entry by entry, and checked before you see it.
Your team
You fill in the roles, the channel and the outside help.
Your real team, channel and providers from your answers; anything missing is marked for you to confirm.
Checking it
Nobody, until the day you need it.
Three independent verifiers check every section against the requirements before you see it.
Making it yours
Your own formatting, headers and approval block.
Your logo and colours, exported to Word, PDF or Excel.
The rest
Your privacy policy and incident response plan are separate jobs, and they have to agree.
They come from the same profile, so they agree. Your first document is free.
Data breach response plan FAQ
The questions people ask
Including how long you have to notify, and whether the scheme applies to small businesses.
What is a data breach response plan?
A data breach response plan sets out who does what when personal information your organisation holds is accessed or disclosed without authorisation, or lost. It covers the four steps the OAIC describes: contain the breach, assess it, notify the Commissioner and the people affected when the Notifiable Data Breaches scheme requires it, and review what happened.
Is a data breach response plan mandatory in Australia?
The Privacy Act does not name a response plan as a requirement, but the OAIC's guide says all entities should have one. The Notifiable Data Breaches scheme's duties, a reasonable and expeditious assessment within 30 days and notification as soon as practicable, are hard to meet without a plan settled in advance.
What is an eligible data breach?
One where personal information is accessed or disclosed without authorisation, or lost in circumstances where that is likely, and a reasonable person would conclude the result is likely to be serious harm to any of the people it is about. If remedial action means serious harm is no longer likely, it is not an eligible data breach.
How long do we have to notify a data breach in Australia?
There is no fixed number of hours. If you suspect an eligible data breach, you must assess it reasonably and expeditiously, taking all reasonable steps to finish within 30 days. Once there are reasonable grounds to believe it is one, you must give the Commissioner a statement and notify the people affected as soon as practicable.
Who do we have to notify?
The Australian Information Commissioner, with a statement giving your identity and contact details, a description of the breach, the kinds of information involved and the steps people should take. Then the people affected: everyone whose information was involved, or only those at risk of serious harm, or, if neither is practicable, by publishing the statement on your website and publicising it.
Does the Notifiable Data Breaches scheme apply to small businesses?
It applies to organisations the Privacy Act covers. Most businesses with an annual turnover of $3 million or less are not covered, but some are anyway: for example a business that provides a health service and holds health information, or one that trades in personal information. Any business that holds tax file number information is covered for breaches of that information.
Is this data breach response plan template free?
Yes. The complete plan is on this page and as an editable Word document, with no sign-up and no card. Fill in the bracketed placeholders and have it approved before you rely on it. If you would rather have it written for your organisation, with your team, reporting channel and providers filled in, PolicyMint generates it and your first document is free.
How much does PolicyMint charge to write a data breach response plan?
A data breach response plan is one full-length document: A$10.00US$6.50£5.00€6.00 at the list rate, or 25 credits. Signing up grants 25 credits, so your first one is free, card required, with no charge today.
Ready when you are
Have a plan ready
before the breach
Answer a few questions about your team, your systems and your outside help. Get a data breach response plan written for your organisation, in your branding, checked against the Privacy Act before you see it.
