Applying the Notifiable Data Breaches scheme to a scenario

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A staff laptop holding unencrypted customer names, addresses and bank details is stolen. Serious harm is likely. What is the next step under the NDB scheme?

A Treat it as not eligible because it was only a laptop

B Treat it as an eligible data breach and notify

2. A staff member emails a customer list to the wrong colleague. The colleague deletes it unread and confirms this. Is it an eligible data breach?

A No, remedial action means serious harm is no longer likely

B Yes, every wrong email is an eligible data breach

3. An eligible data breach has occurred. Who must the organisation notify?

A Only the media and the organisation's shareholders

B The OAIC and the affected individuals

4. An organisation only suspects a breach and is unsure whether it is eligible. What must it do?

A Assess it quickly, within 30 days (s 26WH)

B Wait until the breach is reported in the news

5. Which order correctly applies the scheme to a scenario?

A Assess eligibility, then notify the OAIC and individuals

B Notify everyone first, then decide if it was eligible

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Unauthorised access + serious harm likely + remedial action not possible		AThe breach is eligible, so the organisation must notify the OAIC and affected individuals
2Staff email sent to wrong colleague + no harm likely + data quickly deleted		BThe assessment must be done quickly, within 30 days, and notice given as soon as practicable
3After reasonable grounds to suspect a breach, the organisation must assess it within 30 days and then act		CThe breach is not eligible, so notification to the OAIC is not required
4Once a breach is eligible, notify both the OAIC and the affected individuals as soon as practicable		DIF eligible THEN notify OAIC AND notify individuals
5Breach is eligible, but the company only tells its IT team and keeps quiet		EIF breach suspected THEN assess within 30 days
6Company waits six months to decide if a suspected breach is eligible		FIt must notify the OAIC and affected individuals, not just handle the breach internally

Definitions

NDB scheme steps

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF ___________ = TRUE THEN eligible ← TRUE END IF

IF eligible = TRUE THEN SEND statement TO ____ SEND notice TO affectedPeople

IF eligible = _____ THEN notifyRequired ← FALSE END IF

IF daysTaken _ 30 THEN late ← TRUE END IF

IF eligible = TRUE AND ___ notified THEN penalty ← "Privacy Act" END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A IF harm = unlikely THEN

B eligible ← true

C notify(OAIC)

D notify(individuals)

E ENDIF

Question 2

A IF eligible = true THEN

B notify(OAIC)

C notify(shareholders)

D ENDIF

Question 3

A suspected ← true

B IF suspected = true THEN

C assess(breach)

D max_days ← 90

E ENDIF

Question 4

A IF eligible = true THEN

B statement ← prepare(breach)

C send(statement, ASIC)

D send(statement, individuals)

E ENDIF

Question 5

A IF eligible AND NOT sent THEN

B breach_of_scheme ← true

C penalty ← none

D ENDIF

Answer Key

Applying the Notifiable Data Breaches scheme to a scenario

Section A: Quick Questions

B — Treat it as an eligible data breach and notify

A — No, remedial action means serious harm is no longer likely

B — The OAIC and the affected individuals

A — Assess it quickly, within 30 days (s 26WH)

A — Assess eligibility, then notify the OAIC and individuals

Section B: Match the Pairs

Unauthorised access + serious harm likely + remedial action not possible → The breach is eligible, so the organisation must notify the OAIC and affected individuals

Staff email sent to wrong colleague + no harm likely + data quickly deleted → The breach is not eligible, so notification to the OAIC is not required

After reasonable grounds to suspect a breach, the organisation must assess it within 30 days and then act → IF breach suspected THEN assess within 30 days

Once a breach is eligible, notify both the OAIC and the affected individuals as soon as practicable → IF eligible THEN notify OAIC AND notify individuals

Breach is eligible, but the company only tells its IT team and keeps quiet → It must notify the OAIC and affected individuals, not just handle the breach internally

Company waits six months to decide if a suspected breach is eligible → The assessment must be done quickly, within 30 days, and notice given as soon as practicable

Section C: Definitions

NDB scheme steps — Check if a breach is eligible (serious harm likely), then notify the OAIC and affected people as soon as practicable. Failing to notify risks penalties under the Privacy Act.

Section D: Fill in the Blanks

IF seriousHarm = TRUE THEN
  eligible ← TRUE
END IF

IF eligible = TRUE THEN
  SEND statement TO OAIC
  SEND notice TO affectedPeople

IF eligible = FALSE THEN
  notifyRequired ← FALSE
END IF

IF daysTaken > 30 THEN
  late ← TRUE
END IF

IF eligible = TRUE AND NOT notified THEN
  penalty ← "Privacy Act"
END IF

Section E: Spot the Error

A — A breach is eligible only when serious harm is LIKELY. The condition should be harm = likely, otherwise the notification steps run for the wrong cases.

C — For an eligible breach the organisation must notify the affected individuals (s 26WL), not shareholders. The line should be notify(individuals).

D — For a suspected breach, s 26WH requires the organisation to complete a reasonable and expeditious assessment within 30 days, not 90. It should be max_days ← 30.

C — The statement about an eligible breach goes to the Australian Information Commissioner (OAIC), not ASIC. It should be send(statement, OAIC).

C — Failing to notify after an eligible breach is a breach of the Privacy Act, which can lead to investigation and civil penalties. It should be penalty ← possible.