Notifiable data breaches: the 30-day assessment of a suspected breach

An eligible data breach is unauthorised access to or disclosure of personal information, or its loss where that is likely, that a reasonable person would conclude would be likely to result in serious harm to any person it relates to.

• A breach response procedure that defines an eligible data breach in the words of s 26WE

• A lost phone or misdirected report email not treated as a possible breach

A breach is not an eligible data breach if the practice takes action before serious harm results and, because of that action, a reasonable person would conclude serious harm is not likely (or, for a loss, no unauthorised access or disclosure occurs).

• A record of remedial action taken (for example recalling a misdirected email) and why harm is no longer likely

• Remedial action claimed with no record of what was done

In judging likely serious harm, have regard to the kinds and sensitivity of the information (health information is sensitive), any security measures and the chance they are overcome, who has or could obtain it, and the nature of the harm.

• A written serious-harm assessment against the s 26WG matters for each suspected breach

• Harm judged without writing down the s 26WG matters

Where there are reasonable grounds to suspect an eligible data breach, carry out a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 days after becoming aware.

• The breach register entry with the date the practice became aware and the date the assessment finished

• The 30-day clock started from discovery of the cause, not from awareness of the grounds