All templates

Data Breach Response Plan Template

Prepare your brokerage for a data breach before it happens. Enter your team, systems and contacts to build a response plan that follows the OAIC's steps.

Brokerage and response team

Name, role and contact details of the person authorised to lead the response.

A second contact who can act when the lead is unavailable.

Name and contact details for the privacy assessment and notification decision.

Name and contact details for client, staff and public communications.

Systems and reporting

One system per line, with its owner and the categories of client information held.

How staff report a suspected breach immediately and reach the response lead.

How to reach the team if normal email or systems are compromised.

Where the team keeps a restricted action log and preserved evidence.

Contacts and maintenance

Provider, response number and after-hours route. Leave passwords out.

Incident contact, contact method and relevant escalation instructions.

Claims hotline and policy instructions, or state that no cyber policy is held.

Who maintains the plan, where copies are kept and when the team tests it.

Your response plan

Details to complete

Select a detail to fill it in.

The plan updates from the form. Unfinished details remain blank lines.

Entries stay on this device and are not saved. Download your draft before leaving. Keep client records and passwords out of this tool.
DATA BREACH RESPONSE PLAN Brokerage: ____________________ Plan version: ____________________ Approved by and approval date: ____________________ Next exercise or review: ____________________ ACTIVATE THE PLAN Use this plan for suspected or confirmed loss, unauthorised access or unauthorised disclosure of personal information, including paper records and supplier incidents. Record the discovery time and facts immediately. Contact the lead using the reporting route below. The lead activates the response and assigns additional support. RESPONSE TEAM Response lead: ____________________ Backup lead: ____________________ Assessment owner: ____________________ Communications owner: ____________________ The response lead authorises containment and coordinates the team. The assessment owner records the privacy assessment and notification decision. The communications owner coordinates approved messages. If a person holds several roles, record each assignment. The backup lead acts when the response lead is unavailable. STAFF REPORTING Primary reporting route: ____________________ Backup route if normal systems are unsafe: ____________________ Staff report suspected incidents immediately. Keep borrower documents out of ordinary incident emails. Use the approved evidence location below. SYSTEMS HOLDING CLIENT INFORMATION ____________________ RESPONSE CONTACTS IT support: ____________________ Aggregator: ____________________ Insurer: ____________________ Legal or privacy adviser: ____________________ Use independently verified contact details. Follow the insurer's approval requirements and contractual reporting times. Ask the adviser about other applicable reporting duties. 1. CONTAIN The lead and IT contact stop continuing exposure using steps suited to the incident. Consider isolating affected devices, restricting access and revoking exposed sessions. Preserve relevant logs, messages and records before changes where possible. Avoid destroying evidence or restoring an affected system before IT assesses the evidence and recovery needs. For a supplier incident, establish which brokerage information and accounts are affected. Agree who will investigate and communicate, then record the agreement. 2. ASSESS Assessment owner: ____________________ Record what happened, the information involved, affected people, access protections and who obtained or could obtain the information. Consider the likelihood and consequences of serious harm. Record remedial action and whether it prevents likely serious harm. A dark web alert is a reason to investigate and preserve evidence, not an automatic notification decision. Where the Notifiable Data Breaches scheme applies, assess a suspected eligible breach promptly. Take all reasonable steps to finish within 30 calendar days after the day grounds to suspect an eligible data breach become known. Record the awareness day, assessment target and progress in the incident log. If assessment takes longer, document the reasons and steps taken. 3. NOTIFY Decision owner: ____________________ Where the scheme applies, an eligible breach involves likely serious harm that remedial action has not prevented. Assess exceptions and record the decision with its reasons. If there are reasonable grounds to believe an eligible breach occurred, notify the OAIC and people at risk of serious harm as soon as practicable, unless an exception applies. Do not wait for the assessment period to end. Coordinate with any other entity holding the affected information so responsibility for notification is explicit. Prepare the organisation's contact details, a description of the breach, the information types involved and protective steps for affected people. Select an appropriate, accessible notification method. Communications owner: ____________________ Keep a copy of each notification, its recipients, delivery method and time. Record other regulator, insurer, aggregator or contractual reports separately. 4. REVIEW The lead confirms containment and safe recovery with IT, then records the cause, lessons and corrective actions with owners and due dates. Review suppliers, access controls, retention practices and staff training where relevant. Test that corrective actions work and update this plan and contact list. INCIDENT LOG AND EVIDENCE Location and access arrangements: ____________________ Record the incident reference, discovery and awareness times, decisions, action owners, evidence locations and notification records. Restrict access and preserve original evidence separately from working copies. PLAN MAINTENANCE AND EXERCISE ____________________ Keep a usable copy and verified contact list available if normal systems are inaccessible. Test the reporting route and backup lead without sending real breach notifications. GUIDANCE This is a working response plan based on the OAIC's contain, assess, notify and review approach. Review it for the brokerage's actual legal and contractual duties before approval. OAIC preparation: https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-2-preparing-a-data-breach-response-plan OAIC assessment and notification: https://www.oaic.gov.au/privacy/notifiable-data-breaches/quick-reference-guide-for-responding-to-data-breaches

What a Response Plan Covers

A data breach response plan assigns the people and actions your brokerage needs when personal information is lost, accessed without authority or disclosed without authority. This template builds an editable plan from your response team, systems and contact details. It covers paper records and supplier incidents as well as cyber attacks.

A data breach policy sets your business's expectations for reporting and handling incidents. The response plan puts those expectations into an operating document with a lead, backup contacts and an action log. A small brokerage can assign several roles to one person while retaining a backup.

The OAIC's preparation guidance describes response-team responsibilities, authority and contact arrangements. Give the lead authority to act and keep an accessible copy if ordinary systems are unavailable. Resolve blank lines and have the team approve the plan before relying on it.

Complete the Plan

  1. Enter the brokerage and response team. Name who leads, who acts as backup, who assesses the incident and who coordinates communications. Include contact details for each role.
  2. List systems holding client information, with each system's owner and information categories. Write “identity documents” or “income evidence”, leaving actual borrower records out of the builder.
  3. Describe immediate staff reporting and a backup route if email is compromised. Specify a restricted place for incident records and preserved evidence.
  4. Add the IT response contact, aggregator escalation route, insurer and legal or privacy adviser. Record relevant after-hours arrangements and insurer approval requirements. If no cyber policy is held, state that fact.
  5. Name the plan owner, storage location and exercise schedule. Review the document with those assigned to act, then add its version and approval details.

If you have no named IT response contact, leave its blank line visible while the plan owner arranges support and records a verified escalation route. Invented contact details make the plan unusable. Confirm arrangements with the service provider before approving the plan.

“Load example” uses the fictional Example Harbour Brokerage and reserved .example addresses. Its systems include a loan CRM, business email and a document store. The example's six-month exercise schedule is a planning choice, not a statutory interval. Replace every example contact with a working arrangement.

The plan updates as you type. Editing the document pauses automatic replacement, so later form changes preserve your edits. “Discard edits and rebuild” replaces the edited text with the form's version. The details list always follows the form, including while the document is edited.

Copy, download and print use the displayed document. Blank lines can remain for offline completion. “Clear draft” clears the form and document. Entries stay on your device without uploading or saving a draft, so download your work before leaving.

The OAIC Steps Inside the Plan

The plan follows the OAIC's four steps: contain, assess, notify and review. The OAIC's response guidance allows containment, assessment and notification to overlap as the circumstances require. Preserve evidence while stopping continuing exposure and reducing harm.

For entities covered by the Notifiable Data Breaches (NDB) scheme, suspected eligible breaches require prompt assessment. Take all reasonable steps to finish within 30 calendar days after the day grounds for suspicion become known. The OAIC's quick reference guide explains this assessment trigger and the notification decision.

If reasonable grounds establish an eligible breach, notification is due as soon as practicable, unless an exception applies. The 30-day assessment period does not let the team delay a known notification duty. Record the awareness day and decision times in the incident log.

A notifiable breach under the scheme involves likely serious harm that remedial action has not prevented. A dark web monitoring alert needs investigation into the data and risk. The alert alone does not decide notification. The assessment owner records the facts and reasons.

Privacy Act coverage depends on the entity and information involved. The OAIC's NDB scheme guidance explains coverage, exceptions and incidents involving several entities. The builder does not decide eligibility or replace incident-specific legal advice. Record contractual and other reporting duties separately from the NDB assessment.

Test the Plan

Run a short tabletop exercise by giving the team a fictional incident and asking each person to use the plan. For example, an employee discovers a forwarded client document in an unfamiliar mailbox. Use invented information and simulate every notification.

  1. Ask the employee to find the reporting route. Make the response lead unavailable so the backup must take over.
  2. Have IT describe containment and evidence preservation. Ask the assessment owner to identify missing facts and record when the assessment period starts.
  3. Introduce a supplier response saying some files were downloaded. Ask who decides notification, who prepares messages and how the team coordinates with the supplier.
  4. Finish by checking the action log, contact gaps and recovery decisions. Assign each repair to a person and test it again before closing the exercise.

Do not send exercise messages to clients, regulators or real incident hotlines. Test contact arrangements through an agreed drill. Update the plan after the exercise and whenever staffing, systems or response arrangements change.

Track My Trail Team

Read more

We develop software to simplify trail book management for mortgage brokers. Our tools provide fast and practical insights to help brokers get the most out of their trail books.