Data breach response

What counts

Any unauthorised access to, disclosure of, or loss of personal information we hold. That includes a lost device, a misdirected report, a compromised account and a vendor breach.

What we do

• Contain, immediately. Suspend the account or access path.
• Assess within 24 hours: what information, how many people, what harm is likely.
• Notify the OAIC and affected individuals where the breach is likely to cause serious harm, within 30 days and usually much sooner.
• Tell you plainly what happened, what it means for you and what we are doing.
• Review and fix the cause, with the finding reported to the board.

Where a child is affected

We notify the parent or carer directly, not only by a general notice, and we do it as soon as we have something accurate to say rather than waiting for the full assessment.

Reporting a suspected breach

Email info@caqa.com.au with "Data breach" in the subject, or call 03 8103 8000. We would much rather investigate a false alarm than miss a real one.