In the event of a suspected or known data breach …

• contain breach where possible
• assess if personal information is likely to result in serious harm to affected individuals
  • individuals must be notified promptly
  • Australian Information Commissioner must also be notified
• take action to prevent future breaches