A step-by-step playbook for a notifiable privacy breach.

Step 1: spot a privacy breach

The Act defines a privacy breach, for personal information an agency holds, as unauthorised or accidental access to, or disclosure, alteration, loss or destruction of, the information, or an action that prevents the agency from accessing it, temporarily or permanently. It counts whether it was caused by someone inside or outside the agency, and whether or not it is ongoing.

That is broad. It covers a hacked mailbox, a lost laptop, a document sent to the wrong client, a filing cabinet left open and ransomware that locks you out of your own files.

Step 3: assess whether serious harm is likely

A privacy breach is notifiable if it is reasonable to believe it has caused serious harm to an affected individual, or is likely to do so. Section 113 of the Act says that when you assess this, you must consider:

• any action taken to reduce the risk of harm following the breach;
• whether the personal information is sensitive in nature;
• the nature of the harm that may be caused to affected individuals;
• the person or body that has obtained or may obtain the information, if known;
• whether the information is protected by a security measure; and
• any other relevant matters.

The Office of the Privacy Commissioner provides an online tool, NotifyUs, to help agencies work out whether a breach is notifiable and to report it. The Office describes the self-assessment as a guide; the decision is yours.

Step 5: notify the people affected

The Act also requires an agency to notify each affected individual as soon as practicable after becoming aware of a notifiable breach. If it is not reasonably practicable to notify each person, the agency must give public notice instead, in a form that does not identify anyone affected.

There are limited exceptions and grounds for delay in section 116, for example where notification would be likely to endanger someone's safety or reveal a trade secret. The Office of the Privacy Commissioner says agencies need to tell affected people as soon as they can unless an exception applies, so treat exceptions as narrow and take advice before relying on one.

A good notice is plain and practical: what happened, what information was involved, what you have done, what the person can do to protect themselves, and who to contact.

How records make every step easier

Almost every step above depends on facts: what information was involved, who has it, and whether it is protected. When documents are shared through a ShareAndGo room, the audit log records every view, download and invitation, chained so alterations can be detected. Watermarks show the name, email address and date of whoever viewed a page. View-only recipients never receive the original file. Those facts can turn an anxious guess into a clear assessment, and they are only available if the tools were in place before the breach.