Section 26WK — Privacy Act 1988 (Cth)

Scope

(1) This section applies if an entity is aware that there are reasonable grounds to believe that there has been an eligible data breach of the entity.

Statement

(2) The entity must:

(a) both:

(i) prepare a statement that complies with subsection (3); and

(ii) give a copy of the statement to the Commissioner; and

(b) do so as soon as practicable after the entity becomes so aware.

(3) The statement referred to in subparagraph (2)(a)(i) must set out:

(a) the identity and contact details of the entity; and

(b) a description of the eligible data breach that the entity has reasonable grounds to believe has happened; and

(c) the particular kind or kinds of information concerned; and

(d) recommendations about the steps that individuals should take in response to the eligible data breach that the entity has reasonable grounds to believe has happened.

(4) If the entity has reasonable grounds to believe that the access, disclosure or loss that constituted the eligible data breach of the entity is an eligible data breach of one or more other entities, the statement referred to in subparagraph (2)(a)(i) may also set out the identity and contact details of those other entities.

Related sections

• s 26WG — Whether access or disclosure would be likely, or would not be likely, to result in serious harm—relevant matters
• s 26WH — Assessment of suspected eligible data breach
• s 26WJ — Exception—eligible data breaches of other entities
• s 26WL — Entity must notify eligible data breach
• s 26WM — Exception—eligible data breaches of other entities
• s 26WN — Exception—enforcement related activities

Research how courts apply s 26WK

BriefBridge searches Australian caselaw by meaning — every answer cited to the paragraph.