Privacy and Personal Information Protection Act 1998

This section applies if an officer or employee of a public sector agency is aware that there are reasonable grounds to suspect there may have been an eligible data breach of the agency.

The officer or employee must report the data breach to the head of the public sector agency and the head of the agency must—

immediately make all reasonable efforts to contain the data breach, and

within 30 days after the officer or employee of the agency becomes aware as mentioned in subsection (1)—carry out an assessment of whether the data breach is, or there are reasonable grounds to believe the data breach is, an eligible data breach (an assessment).

An assessment must be carried out in an expeditious way.

Subsection (2)(b) is subject to an extension approved under section 59K.