Data breach readiness
Data Breach Response Plans & NDB Advice
Fixed-fee response plans, notification guidance and breach clauses so you are ready before an incident.
Know what you need? Request a fixed-fee quote and upload your documents. Not sure of scope? Book a short call with a senior lawyer instead.
In short
We help you prepare for a data breach before it happens: a response plan, clear notification decision steps under the Notifiable Data Breaches scheme, and contract clauses that match your capacity to respond. Advice and drafting only.
When a breach happens there is little time. A tested plan and sensible contract terms make the difference between a controlled response and a scramble.
The Notifiable Data Breaches scheme in brief
Under Part IIIC of the Privacy Act 1988 (Cth), covered entities must notify the Office of the Australian Information Commissioner (OAIC) and affected individuals of an eligible data breach likely to result in serious harm. Suspected breaches must be assessed promptly, and where possible within 30 days. The Act also applies to information held by service providers on your behalf, so supplier contracts matter.
What we prepare
- Data breach response plan: roles, escalation, assessment steps and sign-off
- Notification decision guide and draft notices
- Supplier and insurer steps, including who calls whom and when
- Breach clauses for customer and supplier contracts: notice periods, cooperation and cost allocation
- Record keeping templates for incidents and near-misses
- Ransomware payment reporting check under the Cyber Security Act 2024 (Cth)
Scope
This is a preparation and advice service. We do not act in claims, investigations or court proceedings.
Related: privacy and data protection, cyber security contract review, managed IT providers.
Frequently asked questions
What is the Notifiable Data Breaches scheme?
Under Part IIIC of the Privacy Act 1988 (Cth), entities covered by the Act must notify affected individuals and the OAIC when an eligible data breach is likely to result in serious harm. If a breach is only suspected, the entity must assess it promptly and, where possible, within 30 days.
What should a data breach response plan include?
Roles and decision-makers, how incidents are escalated and assessed, a notification decision process, draft notices, supplier and insurer contact steps, record keeping, and a post-incident review. We tailor it to your size and systems.
Can you help us write breach clauses for our contracts?
Yes. We draft and negotiate notification timeframes, cooperation obligations, cost allocation and liability caps in customer and supplier agreements so they match your real ability to respond.
Do you act for us if there is a claim or investigation after a breach?
No. We focus on preparation, notification obligations and contracts, and do not run claims, class actions or court proceedings.
Does ransomware payment reporting apply to us?
The Cyber Security Act 2024 (Cth) introduced a requirement for certain businesses to report ransomware payments. It depends on turnover and other criteria, and we can confirm whether it applies to you.
Two ways to start
Get a fixed fee before any work starts.
Answer a few short questions, attach your documents if you have them, and a senior lawyer replies with the scope and the price.
Know what you need? Request a fixed-fee quote and upload your documents. Not sure of scope? Book a short call with a senior lawyer instead.