Mandatory Data Breach Reporting and Planning
Failing to plan is planning to fail when it comes to data security and breach responses. In this post, we examine the regulatory obligations of entities under the notifiable data breach (NDB) scheme. Specially, we examine when reporting is mandatory and what the features of a broader effective response plan are. When is reporting mandatory? The NDB scheme is found in Part IIIC of the Privacy Act and requires certain businesses to notify affected individuals and the Privacy Commissioner of certain data breaches. The reporting obligation kicks in where there is an ‘eligible data breach,’ which is a data breach where: there is unauthorised access to or disclosure of personal information held by an entity (or information is lost in circumstances where unauthorised access or disclosure is likely to occur);…
