Data breach response plan: what to do in the first days

By the ITLAW Team · Last reviewed November 2026 · General information, not legal advice

Guides › Data Breaches & Cyber › Data breach response plan

The OAIC recommends that every organisation covered by the Privacy Act has a data breach response plan, and that it be tested before it is needed. When a breach happens, a plan saves time, keeps decisions consistent and helps demonstrate that you took reasonable steps.

Step 1: Contain

• Isolate affected systems and accounts, and stop any ongoing unauthorised access.
• Reset compromised credentials and enforce multi-factor authentication.
• Try to recover misdirected or lost information.
• Preserve logs, emails and other evidence. Do not wipe systems before evidence is captured.

Step 2: Assess

• Identify what information was involved, how many people are affected and how sensitive it is.
• Work out who may have the information and what they could do with it.
• Decide whether serious harm is likely. See our Notifiable Data Breaches guide.
• Complete the assessment within 30 days, and much faster where you can.

Step 3: Notify

• Notify the OAIC and affected individuals as soon as practicable for eligible breaches.
• Report any ransomware or extortion payment to the Australian Signals Directorate within 72 hours if your turnover exceeds $3 million.
• Check contracts, insurance policies and industry rules for other notification duties.
• Prepare consistent messages for customers, staff and media.

Step 4: Review

• Identify the root cause and fix it.
• Update policies, training and supplier controls.
• Record lessons learned and update the response plan.

What your plan should contain

• a response team with names, roles and after-hours contacts, including IT, legal, communications and management
• clear triggers for escalating an incident
• contacts for your cyber insurer, IT forensic provider and lawyer
• template notifications and holding statements
• a decision log template
• a schedule for testing the plan at least annually

Frequently asked questions

What are the four steps of data breach response?

The OAIC approach is contain, assess, notify and review.

Should I call a lawyer after a data breach?

Early legal advice helps you decide whether the breach is notifiable, manage communications and preserve legal privilege over the investigation where possible.

Do I need a data breach response plan?

The OAIC recommends one for every organisation covered by the Privacy Act. It is also commonly required by cyber insurers and enterprise customers.

← Back to the Data Breaches & Cyber guide