TemplateDownload as markdown

Data Breach Response Plan — Template

A one-page plan for a small Australian software product. Replace every [bracket]. Written for the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988; use it even if the small business exemption probably covers you — the plan is cheap and improvising mid-incident is not.

Owner: [name — for a solo operator, that’s you: assessor and decision-maker]

Scope: all products operated by [company]. Review annually or after any incident.

What counts as a breach

Unauthorised access to, unauthorised disclosure of, or loss of personal information held by [company] or its processors. Examples worth listing for your own product:

• Database or credential compromise
• An exposed or unauthenticated route leaking account or user-content data
• A processor-side incident at [list your providers: hosting, LLM API, payments, email delivery, subscription management, support mail]
• Data visible to the wrong user through a sharing or permissions feature
• A laptop or session compromise

Step 1 — Contain (immediately, same day)

• Kill the exposure: take the affected route or service offline, rotate the affected credentials and API keys ([list every key and secret you would need to rotate, including your JWT/session secret]), force-expire sessions if account data is implicated.
• Preserve evidence before fixing: export relevant platform logs, note timestamps, take a database snapshot.
• Start a timeline note in the incident register from the first hour.

Step 2 — Assess (start immediately; complete within 30 days at the outside)

• Establish: what data, whose, how many people, over what period, and whether it left [company]’s control.
• Apply the serious-harm test, weighing: sensitivity of the data ([note your own highest-risk categories and audience]), whether the data was protected (hashed vs plaintext), who obtained it, and whether harm is likely.
• Remedial-action exception: if action taken before harm eventuates means serious harm is no longer likely (keys rotated before use, recipient confirmed deletion), the breach is not notifiable. Document the reasoning either way.
• The 30-day clock is the legal maximum for the assessment, not a target. For a small product the assessment should take days.

Step 3 — Notify (as soon as practicable, if serious harm is likely and not remediated)

• OAIC: submit the Notifiable Data Breach form (the smartform is hosted at forms.business.gov.au, form code OAIC-NDB; reachable via oaic.gov.au → Report a data breach). OAIC enquiries: 1300 363 992 (Mon–Thu, 10am–4pm). Contents: description of the breach, kinds of data, recommended steps for individuals.
• Affected users: email via [your email provider] from [your support address], plainly worded: what happened, what data, what [company] has done, what the user should do (change password, watch for phishing that quotes their own data). Notify all affected users directly; decide in advance whether a website-notice-only approach could ever be appropriate for your audience.
• Processors: if the breach originated with a processor, follow their incident process and record their reference number.

Step 4 — Record and review

• Incident register lives in [location — e.g. an ops repo; create on first use]: date, detection source, timeline, data affected, assessment outcome, notification decision and reasoning, fixes shipped.
• Post-incident: root cause, a fix, and an update to this plan if it failed anywhere.

Detection — your known weak point (keep a standing list)

Most small products would not notice a breach. Write down, honestly, the gaps that would stop you noticing one, and treat each as a breach-readiness item, not just ops:

• Current detection sources: [platform logs, user reports to your support address, provider dashboards]
• Open gaps: [e.g. no error monitoring, no alert when a fallback path activates, no alert on API credit exhaustion, no anomaly visibility on data access]

The point of this section is that it is a register, not a boast. A gap you have written down is one you can close; a gap you have not is one you will discover mid-incident.

Key locations

• OAIC NDB form: forms.business.gov.au (code OAIC-NDB) / oaic.gov.au → Report a data breach. Enquiries: 1300 363 992.
• Dashboards: [list every provider dashboard you would need in the first hour]
• This plan + incident register: [location]; keep a copy of the current privacy policy and dated PDFs of processor terms alongside.

This template ships alongside the au-compliance-pack skills: github.com/UgoHarry/au-compliance-pack.

Not legal advice; details verified against OAIC guidance at the time of writing.