What to do if your data has been breached

Dealing with a data breach requires prompt and well-planned action to mitigate the damage, comply with legal requirements, and protect the affected individuals and your business. Here’s a step-by-step guide on what to do in the event of a data breach:

1. Contain the Breach Immediately

• Isolate affected systems to prevent further unauthorized access or data loss.
• Disconnect affected devices or servers from the network if needed.
• Apply patches or fixes for any vulnerabilities exploited in the breach.
• Change passwords and revoke access where necessary.

2. Assess the Breach

• Determine the scope of the breach, including what data was accessed, how the breach occurred, and who was affected.
• Evaluate the risks to individuals (e.g., financial harm, identity theft, privacy violations).
• Identify the type of data compromised (personal data, financial information, intellectual property, etc.).

3. Notify Key Stakeholders

• Internal Notification: Inform management, IT, and legal teams immediately.
• Third-Party Notifications: If third-party systems are involved, inform them promptly to ensure coordinated action.

4. Notify the Office of the Australian Information Commissioner (OAIC)

• If the breach is likely to result in serious harm to individuals, it may be classified as an Eligible Data Breach under the Notifiable Data Breaches (NDB) Scheme.
• You must notify the OAIC and affected individuals as soon as possible.
• The notification should include:
  • The identity and contact details of your organization.
  • A description of the data breach.
  • The type of information involved.
  • Recommendations for individuals to take steps to mitigate any harm.
• Timeline: You must notify the OAIC as soon as practicable, generally within 30 days.

5. Notify Affected Individuals

• Notify individuals whose data was compromised, providing them with information on:
  • What personal information was breached.
  • The potential risks to them.
  • Steps they can take to protect themselves (e.g., monitoring accounts, changing passwords, etc.).
  • Contact information for assistance.
• If notifying individuals would be impracticable, a public statement may be made.

6. Mitigate Further Damage

• Strengthen security measures to prevent further breaches.
• Monitor systems for suspicious activity.
• Work with cybersecurity experts to conduct a thorough review of your systems.
• Implement training for staff on data handling best practices and breach response.

7. Document the Incident

• Keep a detailed record of the breach, including the cause, the response, actions taken, and steps to prevent future incidents.
• This documentation is critical for both internal review and possible OAIC investigation.

8. Review Policies and Procedures

• Conduct a post-breach review to assess the effectiveness of your response.
• Update your data breach response plan if necessary.
• Review and update security protocols, policies, and staff training on data protection.

9. Follow-Up with Individuals

• Provide ongoing support to affected individuals, such as credit monitoring or identity theft protection, if needed.
• Communicate any updates or findings from the investigation, particularly if there are new risks or developments.

10. Consider Legal Implications

• Depending on the nature of the breach, legal action could follow from affected individuals or regulatory authorities.
• Seek legal counsel to ensure you meet all your obligations and protect your organization from potential liability.

Handling a data breach in Australia requires careful attention to both legal requirements and practical security measures. The Notifiable Data Breaches (NDB) Scheme under the Privacy Act 1988 is critical in managing serious breaches that affect individuals’ personal information.

Check the ACSC website for information on what to do if your data has been breached.