If your firm has AML/CTF obligations, the privacy regulator (the OAIC, the Office of the Australian Information Commissioner) tells you to have a plan for the day client information is lost, stolen or sent to the wrong person. This guide sets out what a data breach response plan needs to cover, then gives you a plain data breach response plan template to copy. It is written for small firms: accountants, bookkeepers, agents, conveyancers, lawyers and TCSPs.
In short: a data breach is personal information that is lost, or seen or shared without permission. Your plan names who leads, then covers five moves: contain it the same day, assess it within 30 days, tell the OAIC and the people affected if serious harm is likely, never mention a suspicious matter report, and learn from it. This is general information, not legal advice.
Does a small business need a data breach response plan in Australia?
Most small businesses sit outside the Privacy Act. Your AML/CTF work does not. The OAIC's privacy guidance for reporting entities (August 2026) says businesses that must comply with the AML/CTF Act must also comply with the Privacy Act when they handle personal information for it, including small businesses with an annual turnover of less than $3 million. Our guide to the Privacy Act for AML/CTF businesses explains why.
The same guidance tells you to have a data breach response plan and to know it, because responding quickly reduces the harm, the cost and the damage to your reputation. AML/CTF files are what the OAIC calls a “honey pot”: a breach can lead to identity theft, financial loss or physical harm. The OAIC scales what it expects to a small firm's size and resources, but says that does not make it reasonable to take no steps.
What counts as a data breach: everyday examples
The OAIC's definition: personal information is lost, or subjected to unauthorised access or disclosure. Its examples are a hacked database and information given to the wrong person by mistake. In a small firm it often looks like this:
- A laptop, phone or USB stick holding client information is lost or stolen.
- An email with a client's documents goes to the wrong person.
- Someone gets into a staff email account, or a system they should not be in.
- Paper files or an export are left where others can reach them.
- A provider that holds client information for you tells you it has had an incident.
If you are not sure whether something counts, treat it as if it does and follow the plan.
What a data breach response plan must cover
The OAIC's Privacy Essentials Checklist asks: “Does your organisation have a process to identify and manage a data breach?” Its guidance is to give roles to your leadership and legal advisers, include the staff whose help you need, such as IT, and write the process down.
1. Who does what
One person leads: they decide what happens and keep the record. A backup steps in when the lead cannot be reached. Then list whoever looks after your computers and email, your cyber insurer, your lawyer, and the OAIC (oaic.gov.au, 1300 363 992).
2. Contain it, the same day
Whoever notices tells the lead the same day, without waiting to be sure. Nobody fixes it quietly and nobody deletes anything, because you may need to show later what happened. Then stop it getting worse: ask the wrong recipient of an email to delete it and confirm in writing; change passwords, sign everyone out and turn on two-step sign-in for an account someone got into; lock or wipe a lost device. Write down every step, with the time.
3. Assess it within 30 days
The Privacy Act asks for a “reasonable and expeditious” assessment, with all reasonable steps taken to finish it within 30 days of becoming aware of a suspected breach (Privacy Act s 26WH(2)). The question is whether serious harm is likely. Consider what the information was (ID documents, dates of birth, tax file numbers and bank details make serious harm more likely), how many people it is about, who has it now, and whether it can be got back. If containing it has made serious harm unlikely, it may not need to be notified. Write down why.
4. Is it a notifiable data breach? Tell the OAIC and the people affected
Under the Notifiable Data Breaches scheme, you must notify the OAIC and the people affected when a breach is likely to result in serious harm. The law calls this an eligible data breach. The statement to the OAIC goes in as soon as practicable (s 26WK(2)) and sets out your firm's identity and contact details, a description of the breach, the kinds of information involved, and what the people affected should do (s 26WK(3)). They are then told the same, as soon as practicable after the statement is prepared (s 26WL(3)). Tell your cyber insurer too, and report a cyber attack at cyber.gov.au.
5. The tipping-off exception: when you tell the OAIC only
Tell nobody but AUSTRAC, and the people at your firm who need to know, that a suspicious matter report has been or may be made, or about a notice asking for information under the AML/CTF Act. That means not the client, the OAIC, your insurer or your IT provider. Telling them could be tipping off, an offence under section 123 of the AML/CTF Act. Speak to your compliance officer before anything about the breach is sent.
The duty to notify does not apply where notifying would be inconsistent with a secrecy provision (Privacy Act s 26WP). The OAIC says to apply the notification rules only as far as is needed to avoid that inconsistency. Its example: if a statement to the OAIC would be fine but telling the person would not, you notify the OAIC only. The secrecy provisions it names include sections 121(1), 121(5), 121(6), 124, 128 and 129 of the AML/CTF Act and the tipping-off ban. If a breach touches a client you have reported, your compliance officer checks the wording first.
6. Learn from it, and keep the plan current
Write down what went wrong and what you will change. Close the record but keep it: it shows what you did. Update the plan when a name or number changes, read it at least once a year, and walk through a made-up breach with the people named in it.
Data breach response plan template
Copy this into a document, fill in the square brackets, and give it to everyone at the firm. Keep a printed copy you can reach without your computer.
[Firm name]: data breach response plan
Last updated: [date] · Approved by: [name, signature]
What this is for. What we do when personal information we hold is lost, or is seen, taken or sent without permission. If in doubt, we follow it.
Who does what
- Leads the response: [name] · [mobile] · [email]
- Backup: [name] · [mobile]
- Computers and email: [person or company] · [phone]
- Cyber insurance: [insurer] · [policy number] · [claims phone]
- Lawyer: [name] · [phone]
- Privacy regulator: OAIC · oaic.gov.au · 1300 363 992
The steps
- Tell the lead the same day. Do not fix it quietly or delete anything.
- Contain it the same day. Call [IT contact].
- Record it: when we became aware, who noticed, what information and whose, what we did and when.
- Assess it within 30 days of becoming aware (Privacy Act s 26WH(2)). Is serious harm likely? Record the decision, who made it and why.
- If serious harm is likely, give the OAIC a statement as soon as practicable, tell the people affected and tell our insurer.
- Tell nobody but AUSTRAC, and the people here who need to know, about a suspicious matter report or a notice asking for information under the AML/CTF Act: not the client, the OAIC, our insurer or our IT provider. Where telling a person about the breach would be inconsistent with the AML/CTF Act's secrecy or tipping-off rules, we tell the OAIC only (Privacy Act s 26WP). [Compliance officer] checks the wording.
- Learn and close: the cause, the fix, the date closed.
When the breach happens at your software provider
The OAIC says firms are responsible for the actions of the providers they outsource personal information handling to. Where you and a provider hold the same information, one assessment and one notification can cover everyone (Privacy Act ss 26WJ and 26WM), but if nobody notifies, everyone involved may be in breach. Agree in writing who does what.
CompliDesk's Terms say that if we become aware of a breach affecting your firm's data, we email your firm's owner without delay and within 72 hours, contain it and help you assess it. Your firm decides whether to notify, with our help.
How CompliDesk helps
CompliDesk's Privacy Hub walks your firm through five steps, from your privacy policy and collection notice to the OAIC's 14-question checklist (five of which CompliDesk ticks itself). Step 4 turns a few names and numbers into a plan you can download, and the Hub records anything lost or stolen and counts the days. Staff training includes a 15-minute privacy lesson. From 15 December 2026, CompliDesk deletes ID document photos and selfies 30 days after each identity check is finished, and keeps the record of the check. The Privacy Hub is included in every CompliDesk monthly plan at no extra cost: see pricing. This is general information, not legal advice.
Have your breach plan ready before you need it
CompliDesk helps accountants, bookkeepers, real estate agents, conveyancers, lawyers and TCSPs with AML/CTF and privacy work, including a breach plan written from your own names and numbers. Sign up free today.
Get Started FreeFrequently Asked Questions
Related reading: Privacy Act guide for AML/CTF businesses · The OAIC privacy checklist for AML/CTF firms · Privacy access requests without tipping off · Privacy training for staff · Suspicious matter reports guide · AML record keeping requirements · Frequently asked questions