Data Breach Response Plan (Notifiable Data Breaches Scheme — Australia)
Last updated · Reviewed by the Claim Done team · Not legal advice
A data breach response plan is the documented procedure your business follows when personal information you hold is compromised. Under the Notifiable Data Breaches (NDB) scheme — Part IIIC of the Privacy Act 1988 — Australian businesses with annual turnover above $3 million (and many smaller businesses in regulated industries) must notify both the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable after becoming aware of an eligible data breach (a suspected breach must be assessed within 30 days).
Why this document matters
The OAIC has been increasingly active in enforcing the NDB scheme — penalties for failing to notify or for inadequate response can be substantial. Having a documented response plan is the first thing the OAIC looks for when investigating a breach.
How Claim Done can help
A data breach response plan is a specialist privacy / cybersecurity document — it needs to align with your specific data flows, IT environment, and OAIC guidelines. For the related contractual obligations to your customers and partners regarding data handling, our Service Agreement ($49) includes data-handling and confidentiality clauses you can incorporate into client and contractor agreements.
Start your Service Agreement ($49) →
Not what you needed? Browse all Claim Done services or call 02 8880 1347 Mon-Fri 9am-5pm AEST.