← VCE Data Analytics U4O2

Applying the Notifiable Data Breaches scheme to a scenario

Check if a breach is eligible (serious harm likely), then notify the OAIC and affected people as soon as practicable. Failing to notify risks penalties under the Privacy Act.

Part of: VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 122, ACARA Digital Technologies Years 9–10 — Privacy Principles and Digital Footprints — Module 55, WA Computer Science ATAR Year 11 — Data Management — Module 111, WA Computer Science ATAR Year 11 — Cyber Security — Module 164

Understanding Applying the Notifiable Data Breaches scheme to a scenario in VCE Data Analytics U4O2

What it does: The organisation must carry out a reasonable and expeditious assessment within 30 days of suspecting an eligible breach. It then decides whether to notify. Loss of personal information that is likely to cause serious harm, such as fraud risk from bank details, is an eligible data breach. The organisation gives the OAIC a statement (ss 26WK, 26WR) and notifies affected individuals (s 26WL). Failing to notify is a breach of the Privacy Act and can lead to investigation, penalties and reputational damage.

Common mistakes: A breach is eligible only when serious harm is LIKELY. The condition should be harm = likely, otherwise the notification steps run for the wrong cases. For an eligible breach the organisation must notify the affected individuals (s 26WL), not shareholders. The line should be notify(individuals).

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Applying the Notifiable Data Breaches scheme to a scenario to a class →

This module's key terms are also in a printable crossword (Modules 115–134) and word search (Modules 115–150).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A staff laptop holding unencrypted customer names, addresses and bank details is stolen. Serious harm is likely. What is the next step under the NDB scheme?
Treat it as an eligible data breach and notifyTreat it as not eligible because it was only a laptop
Matches
Breach is eligible, but the company only tells its IT team and keeps quiet
↓
It must notify the OAIC and affected individuals, not just handle the breach internally
Applying
Meanings
Term
NDB scheme steps
Meaning
Check if a breach is eligible (serious harm likely), then notify the OAIC and affected people as soon as practicable. Failing to notify risks penalties under the Privacy Act.
Practice
IF seriousHarmLikely = TRUE AND remedialFailed = TRUE THEN
Testing
Gaps
IF = TRUE THEN
Check Answer
Spots
1IF harm = unlikely THEN
2 eligible ← true

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Zebra' badge — Pattern Matcher, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A staff laptop holding unencrypted customer names, addresses and bank details is stolen. Serious harm is likely. What is the next step under the NDB scheme?
A. Treat it as not eligible because it was only a laptop
B. Treat it as an eligible data breach and notify ✓
Loss of personal information that is likely to cause serious harm, such as fraud risk from bank details, is an eligible data breach.
2. A staff member emails a customer list to the wrong colleague. The colleague deletes it unread and confirms this. Is it an eligible data breach?
A. No, remedial action means serious harm is no longer likely ✓
B. Yes, every wrong email is an eligible data breach
A breach is not eligible if quick action prevents the likely serious harm. The organisation should still record what happened.
3. An eligible data breach has occurred. Who must the organisation notify?
A. Only the media and the organisation's shareholders
B. The OAIC and the affected individuals ✓
The organisation gives the OAIC a statement (ss 26WK, 26WR) and notifies affected individuals (s 26WL).
4. An organisation only suspects a breach and is unsure whether it is eligible. What must it do?
A. Assess it quickly, within 30 days (s 26WH) ✓
B. Wait until the breach is reported in the news
A reasonable and expeditious assessment must be made within 30 days of becoming aware of reasonable grounds to suspect an eligible breach.
5. Which order correctly applies the scheme to a scenario?
A. Assess eligibility, then notify the OAIC and individuals ✓
B. Notify everyone first, then decide if it was eligible
The steps are: check whether serious harm is likely, then notify as soon as practicable if the breach is eligible.

Match the Pairs

Unauthorised access + serious harm likely + remedial action not possible → The breach is eligible, so the organisation must notify the OAIC and affected individuals
Staff email sent to wrong colleague + no harm likely + data quickly deleted → The breach is not eligible, so notification to the OAIC is not required
After reasonable grounds to suspect a breach, the organisation must assess it within 30 days and then act → IF breach suspected THEN assess within 30 days
Once a breach is eligible, notify both the OAIC and the affected individuals as soon as practicable → IF eligible THEN notify OAIC AND notify individuals
Breach is eligible, but the company only tells its IT team and keeps quiet → It must notify the OAIC and affected individuals, not just handle the breach internally
Company waits six months to decide if a suspected breach is eligible → The assessment must be done quickly, within 30 days, and notice given as soon as practicable

Key Term

NDB scheme steps
Check if a breach is eligible (serious harm likely), then notify the OAIC and affected people as soon as practicable. Failing to notify risks penalties under the Privacy Act.

Fill in the Blanks

1. IF seriousHarm = TRUE THEN eligible ← TRUE END IF
Hint: Type the camelCase variable that stores the result of the test for whether serious harm is likely.
2. IF eligible = TRUE THEN SEND statement TO OAIC SEND notice TO affectedPeople
Hint: Type the acronym of the Commissioner's office that receives the statement about the breach.
3. IF eligible = FALSE THEN notifyRequired ← FALSE END IF
Hint: Type the Boolean value that means the breach is not eligible, so no notification is required.
4. IF daysTaken > 30 THEN late ← TRUE END IF
Hint: Type the comparison operator that checks whether the assessment took more days than the allowed limit.
5. IF eligible = TRUE AND NOT notified THEN penalty ← "Privacy Act" END IF
Hint: Type the logical operator that shows the organisation failed to notify, which risks a penalty.

Spot the Error

Question 1
A IF harm = unlikely THEN
B eligible ← true
C notify(OAIC)
D notify(individuals)
E ENDIF
Line A — A breach is eligible only when serious harm is LIKELY. The condition should be harm = likely, otherwise the notification steps run for the wrong cases.
Question 2
A IF eligible = true THEN
B notify(OAIC)
C notify(shareholders)
D ENDIF
Line C — For an eligible breach the organisation must notify the affected individuals (s 26WL), not shareholders. The line should be notify(individuals).
Question 3
A suspected ← true
B IF suspected = true THEN
C assess(breach)
D max_days ← 90
E ENDIF
Line D — For a suspected breach, s 26WH requires the organisation to complete a reasonable and expeditious assessment within 30 days, not 90. It should be max_days ← 30.
Question 4
A IF eligible = true THEN
B statement ← prepare(breach)
C send(statement, ASIC)
D send(statement, individuals)
E ENDIF
Line C — The statement about an eligible breach goes to the Australian Information Commissioner (OAIC), not ASIC. It should be send(statement, OAIC).
Question 5
A IF eligible AND NOT sent THEN
B breach_of_scheme ← true
C penalty ← none
D ENDIF
Line C — Failing to notify after an eligible breach is a breach of the Privacy Act, which can lead to investigation and civil penalties. It should be penalty ← possible.

Student with a class code? Join your class →