What should I do if I have become aware of, or have caused, a privacy breach?
If you have become aware that your agency has been involved in a privacy breach (personal information has been lost or accidentally disclosed), there are four key points you'll need to work through:
- Contain
- Assess
- Notify
- Prevent
For more information on each of the above steps, we have extensive guidance on notifiable privacy breaches.
You must report privacy breaches that have caused or are likely to cause serious harm by using our online NotifyUs reporting tool. NotifyUs will also help you assess the seriousness of the privacy breach and whether you must inform our office and affected individuals.
If you are an individual and your information has been part of a privacy breach, we have further information to read(external link).
Updated October 2025