← VCE Data Analytics U4O2

Assessing a suspected breach (s 26WH)

If an entity suspects an eligible data breach, it must quickly and reasonably assess within 30 days whether serious harm is likely and whether a breach has occurred.

Part of: VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 119, WA Computer Science ATAR Year 11 — Cyber Security — Module 161

Understanding Assessing a suspected breach (s 26WH) in VCE Data Analytics U4O2

What it does: The assessment is triggered by suspicion based on reasonable grounds, not by proof that a breach has happened. If the assessment finds serious harm is likely, the incident is an eligible data breach and notification duties follow. The assessment is a legal duty. It must be reasonable (a proper investigation) and expeditious (prompt). Section 26WH decides whether the breach is eligible. If it is, the entity must give a statement to the Commissioner and notify individuals under later sections of the scheme.

Common mistakes: Section 26WH gives an entity 30 days to complete its assessment, not 14. It should be daysAllowed ← 30. The duty to assess starts when the entity has reasonable grounds to suspect an eligible data breach. The condition should be reasonableGrounds.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Assessing a suspected breach (s 26WH) to a class →

This module's key terms are also in a printable crossword (Modules 115–134) and word search (Modules 115–150).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

A business suspects that customer data may have been accessed by an attacker. What does s 26WH require it to do?

Carry out a reasonable and expeditious assessment of whether an eligible data breach has occurredWait until it is certain a breach happened before doing anything

Matches

assess_breach(deadline = 90 days)

↓

The wrong time limit is used. The assessment must be completed within 30 days, not 90 days.

Applying

Meanings

Term

s 26WH assessment

Meaning

If an entity suspects an eligible data breach, it must quickly and reasonably assess within 30 days whether serious harm is likely and whether a breach has occurred.

Practice

suspected ← TRUE

Testing

Gaps

startAssessment(maxDays = )

Check Answer

Spots

1suspect ← true

2daysAllowed ← 14

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A business suspects that customer data may have been accessed by an attacker. What does s 26WH require it to do?

A. Carry out a reasonable and expeditious assessment of whether an eligible data breach has occurred ✓

B. Wait until it is certain a breach happened before doing anything

Section 26WH is triggered by reasonable grounds to suspect a breach. The entity does not need certainty before it starts assessing.

2. What is the time limit for completing the assessment of a suspected eligible data breach?

A. Take all reasonable steps to finish within 30 days of becoming aware ✓

B. Take all reasonable steps to finish within 30 hours of becoming aware

The 30-day limit starts when the entity becomes aware of the grounds for suspicion. The assessment must also be done expeditiously, so it should not take longer than necessary.

3. Which standard of assessment does s 26WH require?

A. Reasonable and expeditious (sensible and quick) ✓

B. Optional and informal, done when staff have time

The assessment is a legal duty. It must be reasonable (a proper investigation) and expeditious (prompt).

4. What is the main question the assessment must answer?

A. Whether the breach will make the organisation's share price fall

B. Whether the breach is likely to result in serious harm to affected individuals ✓

The scheme protects individuals. An eligible data breach involves unauthorised access or disclosure that is likely to cause serious harm to those people.

5. An IT manager sees unusual logins on a database of personal information. Which action best follows s 26WH?

A. Ignore it because no customer has complained yet

B. Start an assessment now because there are reasonable grounds to suspect a breach ✓

Reasonable grounds to suspect, such as unusual logins, are enough to start the assessment. The entity does not need a complaint or proof.

Match the Pairs

s 26WH(2) → The entity must carry out a reasonable and expeditious assessment within 30 days of becoming aware of reasonable grounds to suspect an eligible data breach

30 days → The maximum time an entity has to finish assessing whether a suspected breach is an eligible data breach

Reasonable grounds to suspect a breach is enough to start the assessment, even before the entity is certain → if (reasonable_grounds_to_suspect) { start_assessment(); }

The assessment decides whether a reasonable person would conclude that serious harm is likely to result for affected individuals → if (serious_harm_likely) { eligible_breach = true; }

assess_breach(deadline = 90 days) → The wrong time limit is used. The assessment must be completed within 30 days, not 90 days.

wait until breach_confirmed, then start assessment → The entity waits for certainty. It must start assessing as soon as it has reasonable grounds to suspect a breach.

Key Term

s 26WH assessment

If an entity suspects an eligible data breach, it must quickly and reasonably assess within 30 days whether serious harm is likely and whether a breach has occurred.

Fill in the Blanks

1. IF breachSuspected THEN startAssessment(maxDays = 30) END IF

Hint: Type the number of days the entity has to complete the assessment.

2. IF breachSuspected = TRUE THEN assessBreach() END IF

Hint: Type the keyword that starts a decision, so the assessment only runs when a breach is suspected.

3. IF seriousHarmLikely = TRUE THEN eligibleBreach = TRUE END IF

Hint: Type the Boolean value that means serious harm is likely, which makes the breach eligible.

4. IF daysTaken <= 30 THEN assessmentStatus = "on time" END IF

Hint: Type the comparison operator meaning the assessment took no more than the allowed days.

5. grounds = TRUE harmLikely = TRUE eligible = grounds AND harmLikely

Hint: Type the logical operator that needs both reasonable grounds and likely serious harm to be true.

Spot the Error

Question 1

A suspect ← true

B daysAllowed ← 14

C assess(suspect, daysAllowed)

Line B — Section 26WH gives an entity 30 days to complete its assessment, not 14. It should be daysAllowed ← 30.

Question 2

A IF noGrounds THEN

B startAssessment()

C END IF

Line A — The duty to assess starts when the entity has reasonable grounds to suspect an eligible data breach. The condition should be reasonableGrounds.

Question 3

A days ← 12

B limit ← 30

C onTime ← days >= limit

Line C — The assessment is on time only when days taken is less than or equal to the 30-day limit. It should use <=, not >=.

Question 4

A suspect ← true

B assess(30)

C seriousHarm ← judge(evidence)

D eligible ← NOT seriousHarm

Line D — A breach is eligible when serious harm is likely, so eligible should be seriousHarm. NOT reverses the test.

Question 5

A harmLikely ← false

B IF NOT harmLikely THEN

C eligible ← true

D ELSE eligible ← false

Line B — The breach is only eligible when serious harm is likely, so the test should be IF harmLikely THEN. NOT flips the logic.

Student with a class code? Join your class →