# Data Breach Response Plan — Template

*A one-page plan for a small Australian software product. Replace every [bracket]. Written for the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988; use it even if the small business exemption probably covers you — the plan is cheap and improvising mid-incident is not.*

**Owner:** [name — for a solo operator, that's you: assessor and decision-maker]

**Scope:** all products operated by [company]. Review annually or after any incident.

---

## What counts as a breach

Unauthorised access to, unauthorised disclosure of, or loss of personal information held by [company] or its processors. Examples worth listing for your own product:

- Database or credential compromise
- An exposed or unauthenticated route leaking account or user-content data
- A processor-side incident at [list your providers: hosting, LLM API, payments, email delivery, subscription management, support mail]
- Data visible to the wrong user through a sharing or permissions feature
- A laptop or session compromise

## Step 1 — Contain (immediately, same day)

- Kill the exposure: take the affected route or service offline, rotate the affected credentials and API keys ([list every key and secret you would need to rotate, including your JWT/session secret]), force-expire sessions if account data is implicated.
- Preserve evidence before fixing: export relevant platform logs, note timestamps, take a database snapshot.
- Start a timeline note in the incident register from the first hour.

## Step 2 — Assess (start immediately; complete within 30 days at the outside)

- Establish: what data, whose, how many people, over what period, and whether it left [company]'s control.
- Apply the serious-harm test, weighing: sensitivity of the data ([note your own highest-risk categories and audience]), whether the data was protected (hashed vs plaintext), who obtained it, and whether harm is likely.
- Remedial-action exception: if action taken before harm eventuates means serious harm is no longer likely (keys rotated before use, recipient confirmed deletion), the breach is not notifiable. Document the reasoning either way.
- The 30-day clock is the legal maximum for the assessment, not a target. For a small product the assessment should take days.

## Step 3 — Notify (as soon as practicable, if serious harm is likely and not remediated)

- **OAIC:** submit the Notifiable Data Breach form (the smartform is hosted at forms.business.gov.au, form code OAIC-NDB; reachable via oaic.gov.au → Report a data breach). OAIC enquiries: 1300 363 992 (Mon–Thu, 10am–4pm). Contents: description of the breach, kinds of data, recommended steps for individuals.
- **Affected users:** email via [your email provider] from [your support address], plainly worded: what happened, what data, what [company] has done, what the user should do (change password, watch for phishing that quotes their own data). Notify all affected users directly; decide in advance whether a website-notice-only approach could ever be appropriate for your audience.
- **Processors:** if the breach originated with a processor, follow their incident process and record their reference number.

## Step 4 — Record and review

- Incident register lives in [location — e.g. an ops repo; create on first use]: date, detection source, timeline, data affected, assessment outcome, notification decision and reasoning, fixes shipped.
- Post-incident: root cause, a fix, and an update to this plan if it failed anywhere.

## Detection — your known weak point (keep a standing list)

Most small products would not notice a breach. Write down, honestly, the gaps that would stop you noticing one, and treat each as a breach-readiness item, not just ops:

- Current detection sources: [platform logs, user reports to your support address, provider dashboards]
- Open gaps: [e.g. no error monitoring, no alert when a fallback path activates, no alert on API credit exhaustion, no anomaly visibility on data access]

The point of this section is that it is a register, not a boast. A gap you have written down is one you can close; a gap you have not is one you will discover mid-incident.

## Key locations

- OAIC NDB form: forms.business.gov.au (code OAIC-NDB) / oaic.gov.au → Report a data breach. Enquiries: 1300 363 992.
- Dashboards: [list every provider dashboard you would need in the first hour]
- This plan + incident register: [location]; keep a copy of the current privacy policy and dated PDFs of processor terms alongside.

This template ships alongside the au-compliance-pack skills: [github.com/UgoHarry/au-compliance-pack](https://github.com/UgoHarry/au-compliance-pack).

---

*Template published as a companion to the Compliant by Design essay series (ugoharry.com). Not legal advice; details verified against OAIC guidance at the time of writing.*