Assessing a suspected breach (s 26WH)

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A business suspects that customer data may have been accessed by an attacker. What does s 26WH require it to do?

A Carry out a reasonable and expeditious assessment of whether an eligible data breach has occurred

B Wait until it is certain a breach happened before doing anything

2. What is the time limit for completing the assessment of a suspected eligible data breach?

A Take all reasonable steps to finish within 30 days of becoming aware

B Take all reasonable steps to finish within 30 hours of becoming aware

3. Which standard of assessment does s 26WH require?

A Reasonable and expeditious (sensible and quick)

B Optional and informal, done when staff have time

4. What is the main question the assessment must answer?

A Whether the breach will make the organisation's share price fall

B Whether the breach is likely to result in serious harm to affected individuals

5. An IT manager sees unusual logins on a database of personal information. Which action best follows s 26WH?

A Ignore it because no customer has complained yet

B Start an assessment now because there are reasonable grounds to suspect a breach

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1s 26WH(2)		AThe wrong time limit is used. The assessment must be completed within 30 days, not 90 days.
230 days		BThe entity must carry out a reasonable and expeditious assessment within 30 days of becoming aware of reasonable grounds to suspect an eligible data breach
3Reasonable grounds to suspect a breach is enough to start the assessment, even before the entity is certain		Cif (reasonable_grounds_to_suspect) { start_assessment(); }
4The assessment decides whether a reasonable person would conclude that serious harm is likely to result for affected individuals		DThe maximum time an entity has to finish assessing whether a suspected breach is an eligible data breach
5assess_breach(deadline = 90 days)		Eif (serious_harm_likely) { eligible_breach = true; }
6wait until breach_confirmed, then start assessment		FThe entity waits for certainty. It must start assessing as soon as it has reasonable grounds to suspect a breach.

Definitions

s 26WH assessment

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF breachSuspected THEN startAssessment(maxDays = __) END IF

__ breachSuspected = TRUE THEN assessBreach() END IF

IF seriousHarmLikely = ____ THEN eligibleBreach = TRUE END IF

IF daysTaken __ 30 THEN assessmentStatus = "on time" END IF

grounds = TRUE harmLikely = TRUE eligible = grounds ___ harmLikely

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A suspect ← true

B daysAllowed ← 14

C assess(suspect, daysAllowed)

Question 2

A IF noGrounds THEN

B startAssessment()

C END IF

Question 3

A days ← 12

B limit ← 30

C onTime ← days >= limit

Question 4

A suspect ← true

B assess(30)

C seriousHarm ← judge(evidence)

D eligible ← NOT seriousHarm

Question 5

A harmLikely ← false

B IF NOT harmLikely THEN

C eligible ← true

D ELSE eligible ← false

Answer Key

Assessing a suspected breach (s 26WH)

Section A: Quick Questions

A — Carry out a reasonable and expeditious assessment of whether an eligible data breach has occurred

A — Take all reasonable steps to finish within 30 days of becoming aware

A — Reasonable and expeditious (sensible and quick)

B — Whether the breach is likely to result in serious harm to affected individuals

B — Start an assessment now because there are reasonable grounds to suspect a breach

Section B: Match the Pairs

s 26WH(2) → The entity must carry out a reasonable and expeditious assessment within 30 days of becoming aware of reasonable grounds to suspect an eligible data breach

30 days → The maximum time an entity has to finish assessing whether a suspected breach is an eligible data breach

Reasonable grounds to suspect a breach is enough to start the assessment, even before the entity is certain → if (reasonable_grounds_to_suspect) { start_assessment(); }

The assessment decides whether a reasonable person would conclude that serious harm is likely to result for affected individuals → if (serious_harm_likely) { eligible_breach = true; }

assess_breach(deadline = 90 days) → The wrong time limit is used. The assessment must be completed within 30 days, not 90 days.

wait until breach_confirmed, then start assessment → The entity waits for certainty. It must start assessing as soon as it has reasonable grounds to suspect a breach.

Section C: Definitions

s 26WH assessment — If an entity suspects an eligible data breach, it must quickly and reasonably assess within 30 days whether serious harm is likely and whether a breach has occurred.

Section D: Fill in the Blanks

IF breachSuspected THEN
  startAssessment(maxDays = 30)
END IF

IF breachSuspected = TRUE THEN
  assessBreach()
END IF

IF seriousHarmLikely = TRUE THEN
  eligibleBreach = TRUE
END IF

IF daysTaken <= 30 THEN
  assessmentStatus = "on time"
END IF

grounds = TRUE
harmLikely = TRUE
eligible = grounds AND harmLikely

Section E: Spot the Error

B — Section 26WH gives an entity 30 days to complete its assessment, not 14. It should be daysAllowed ← 30.

A — The duty to assess starts when the entity has reasonable grounds to suspect an eligible data breach. The condition should be reasonableGrounds.

C — The assessment is on time only when days taken is less than or equal to the 30-day limit. It should use <=, not >=.

D — A breach is eligible when serious harm is likely, so eligible should be seriousHarm. NOT reverses the test.

B — The breach is only eligible when serious harm is likely, so the test should be IF harmLikely THEN. NOT flips the logic.