← VCE Data Analytics U4O2

Notifying affected individuals (s 26WL)

Organisation must tell individuals at risk of serious harm about an eligible data breach, what information was involved and what steps to take, directly or by publishing a notice.

Part of: VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 121, WA Computer Science ATAR Year 11 — Cyber Security — Module 163

Understanding Notifying affected individuals (s 26WL) in VCE Data Analytics U4O2

What it does: Direct notification means telling each affected individual personally, and the message must say what information was involved. s 26WL requires the statement to include recommended steps so individuals can protect themselves from serious harm. If direct contact is impractical, the organisation must publish a notice on its website and take reasonable steps to publicise it.

Common mistakes: Under s 26WL the organisation must notify the individuals at risk of serious harm, not only the Commissioner. It should be notify(individuals, info). When contact details are available, the organisation notifies the person directly. Publishing a notice is only the fallback (the ELSE branch) if direct contact is impractical. It should be notifyDirectly(person).

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Notifying affected individuals (s 26WL) to a class →

This module's key terms are also in a printable crossword (Modules 115–134) and word search (Modules 115–150).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Which individuals must an organisation notify under s 26WL after an eligible data breach?

Those at risk of serious harm from the breachEvery customer on the organisation's database, whether affected or not

Matches

Notice says: 'A breach occurred. We are investigating.'

↓

The notice leaves out the kind of information involved and the steps individuals should take, both required by s 26WL.

Applying

Meanings

Term

s 26WL

Meaning

Organisation must tell individuals at risk of serious harm about an eligible data breach, what information was involved and what steps to take, directly or by publishing a notice.

Practice

IF eligible data breach THEN

Testing

Gaps

Notifying affected individuals: s

Check Answer

Spots

2 SET info TO breachDetails

3 notify(Commissioner, info)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which individuals must an organisation notify under s 26WL after an eligible data breach?

A. Every customer on the organisation's database, whether affected or not

B. Those at risk of serious harm from the breach ✓

s 26WL requires notification of individuals at risk of serious harm (or those whose information was involved), not everyone the organisation holds data on.

2. Which item must the notification to an individual include?

A. The kinds of information involved in the breach ✓

B. The names of the staff member who caused the breach

The notice must say what information was involved so people can judge their risk. It does not need to name staff.

3. What else must the notification tell individuals?

A. What steps they should take in response to the breach ✓

B. That they must wait for the organisation to fix everything

Recommended steps, such as changing passwords or watching bank statements, help people reduce their harm.

4. Which is an example of direct notification?

A. Emailing each at-risk customer with details of the breach ✓

B. Posting a general notice on a staff noticeboard

Direct notification means contacting the individuals themselves, for example by email, SMS, phone or letter.

5. An organisation cannot practically contact the affected individuals. What should it do?

A. Skip notifying individuals because contacting them is too hard

B. Publish a notice on its website and take reasonable steps to publicise it ✓

If direct contact is impractical, the organisation must publish a notice on its website and take reasonable steps to publicise it.

Match the Pairs

s 26WL(2) → The organisation must give the affected individuals a statement of the breach, the information involved and recommended steps, either directly or by publishing a notice

Publish a notice on the website → Used when direct contact with the affected individuals is not practicable, so the organisation makes the statement public instead

Direct notification: the organisation contacts each individual at risk of serious harm → Email to each affected customer: 'Your name and address were accessed in a breach'

Recommended steps for individuals: the notice must tell people how to reduce harm → Notice says: 'Change your password and watch your bank statements for unusual activity'

Notice says: 'A breach occurred. We are investigating.' → The notice leaves out the kind of information involved and the steps individuals should take, both required by s 26WL.

Organisation notifies only the Commissioner and stays silent to customers → s 26WL also requires the organisation to tell the individuals at risk of serious harm, directly or by publishing a notice, not just the Commissioner.

Key Term

s 26WL

Organisation must tell individuals at risk of serious harm about an eligible data breach, what information was involved and what steps to take, directly or by publishing a notice.

Fill in the Blanks

1. Notifying affected individuals: s 26WL

Hint: Type the section code for the notification duty, written after 's'.

2. IF breach = eligible THEN notify(individualsAtRisk)

Hint: Type the action the organisation takes toward people at risk.

3. notify(person, infoInvolved, steps)

Hint: Type the item that tells people what they should do next.

4. IF directContact = impractical THEN publish(noticeOnWebsite)

Hint: Type the action used when contacting each person is impractical.

5. Notify people at risk of serious harm

Hint: Type the level of harm that triggers the duty to notify.

Spot the Error

Question 1

A IF eligibleBreach = TRUE THEN

B SET info TO breachDetails

C notify(Commissioner, info)

D END IF

Line C — Under s 26WL the organisation must notify the individuals at risk of serious harm, not only the Commissioner. It should be notify(individuals, info).

Question 2

A FOR EACH person IN atRiskList

B c = getContact(person)

C IF c = AVAILABLE THEN

D publishNotice(person)

E ELSE publishNotice()

Line D — When contact details are available, the organisation notifies the person directly. Publishing a notice is only the fallback (the ELSE branch) if direct contact is impractical. It should be notifyDirectly(person).

Question 3

A SET msg TO NEW Statement()

B msg.add(breachDescription)

C msg.add(organisationLogo)

D msg.add(recommendedSteps)

Line C — The notification must say what information was involved in the breach. A logo does not tell people this. It should be msg.add(informationInvolved).

Question 4

A steps ← NEW LIST

B ADD 'do nothing' TO steps

C ADD 'watch accounts' TO steps

D notify(person, steps)

Line B — The recommended steps must help individuals reduce the risk of serious harm, such as resetting a password. Telling them to do nothing is not a useful step.

Question 5

A statement ← prepareStatement()

B IF seriousHarm = TRUE THEN

C waitSixMonths()

D END IF

Line C — Once the statement is prepared, the organisation must notify affected individuals as soon as practicable, not delay for months. It should be notifyAsSoonAsPracticable().

Student with a class code? Join your class →