Data Breach Instructions

About you

These details help us contact the right people quickly.

Organisation name *

Tip:Use the exact legal entity name (including “Pty Ltd”, etc.).

Organisation headquarters / primary jurisdiction

Your name *

Your role / title

Your email *

Your phone

Do you have a privacy officer / DPO?

For GDPR, we may need a contact point for regulators.

Privacy officer / DPO contact (if different)

What does your organisation do? (one sentence)

Regulatory scope (quick check)

These questions help identify which notification regimes may apply.

Australia: are you likely an “APP entity” under the Privacy Act 1988 (Cth)?

Commonly yes for Australian Government agencies, and many businesses (often those with turnover above $3M, certain health service providers, etc.).

New Zealand: are you an “agency” under the Privacy Act 2020?

GDPR: what is your organisation’s role for the affected data?

If you’re a processor, notification obligations may run to your customer/controller first.

California: do you collect/process personal information of California residents?

Any notes on privacy compliance structure (optional)

Incident overview

These questions help determine the nature of the incident and key timeframes.

When did you first become aware of the incident? *

For GDPR, the 72-hour clock is typically tied to when you became “aware”.

Incident window (if known)

Is the incident contained?

Incident type

Systems / services affected

What happened? (brief summary) *

Was there a ransom / extortion demand?

Have you contacted law enforcement?

Affected people and locations

Which laws apply can depend on where affected individuals are located and where your organisation operates.

Who may be affected?

Approx. number of affected individuals (total)

Where are affected individuals located? *

List countries/regions and (if possible) rough counts by region.

Could GDPR apply?

Could California law be relevant?

Personal information involved

The type of data involved is critical for notifiability and risk assessment.

California (if relevant): which “data elements” may be involved? (select all that apply)

Guidance:California breach notification / statutory damages analysis often depends on the specific data elements and whether the data was unencrypted/unredacted.

Social Security number (SSN) Driver’s licence / state ID number Financial account number + access code/password Payment card number + security code/expiration (if applicable) Medical information Health insurance information Biometric data (e.g., fingerprint, face template) Username/email + password or security question/answer Not sure / not applicable

If California residents are affected: was the compromised data unencrypted and unredacted?

Is the data linked to an individual’s name (or initial + last name)?

Does the data include “sensitive” / special category data?

Examples: health, biometrics, sexuality, political opinions, union membership, criminal records.

Are any affected individuals under 16?

Was the data encrypted or otherwise protected?

For some laws, encryption may affect notification and liability.

If encrypted, were keys/credentials also compromised?

Approx. number of records / files exposed (if known)

Access, disclosure and evidence

Notifiability often depends on whether there was unauthorised access/disclosure and whether serious harm or risk is likely.

What best describes the breach event(s)? (select all that apply)

Unauthorised access (e.g., attacker access to systems/data) Unauthorised disclosure (e.g., sent to wrong recipient, public posting) Loss (e.g., lost laptop, missing paper files) Data exfiltration / theft is confirmed Exfiltration is suspected but not confirmed Data was publicly accessible (e.g., no auth)

What evidence do you have of access/exfiltration?

Did a third party / supplier contribute to or cause the incident?

Include cloud providers, MSPs, SaaS vendors, payment processors, etc.

Where was the affected data stored/processed?

Risk / serious harm assessment

These questions help assess whether notification thresholds are met (e.g., “likely to cause serious harm” or “risk/high risk” to individuals).

Any known misuse of information?

Could the incident cause serious harm to individuals?

Consider financial loss, identity theft, humiliation, discrimination, physical harm, etc.

What are the likely consequences / harms?

Are any vulnerable people involved?

Containment and remedial action

Under some laws, prompt remedial action may affect whether notification is required.

What steps have you taken so far?

Have you taken remedial action that removes/reduces the likelihood of serious harm?

Example: quickly securing exposed data before evidence of access; forcing credential resets; disabling compromised tokens.

Have you engaged a forensic / incident response provider?

Key unknowns / open questions

Notifications (if any)

Tell us what notifications have already been made or are being considered.

Have you notified any regulator/authority?

Examples: OAIC (Australia), OPC (NZ), EU supervisory authority, ICO (UK), state AGs (US).

Have you notified affected individuals?

Notification details (if any)

Do you need help preparing notices (regulator and/or affected individuals)?

Contracts, insurers and other obligations

Separate to privacy laws, contracts and insurers may have notification requirements.

Do you have cyber insurance?

Do any customers/partners require notice under contract?

Contract / insurer details (optional)

Final notes

Add anything else that may affect assessment or urgency.

Anything else we should know? (optional)

Complete the Questionnaire

About you

Regulatory scope (quick check)

Incident overview

Affected people and locations

Personal information involved

Access, disclosure and evidence

Risk / serious harm assessment

Containment and remedial action

Notifications (if any)

Contracts, insurers and other obligations

Final notes