Holistic Healthcare
0480 732 743

REP-56-Data Breach Assessment Report

Data Breach Assessment & Report Form

Assessment of risks, breach containment, mitigation, and regulatory reporting record.

Introduction

This Report has been designed to assist the Privacy Officer in assessing the risks to the individuals and the organisation and in capturing a record of the steps taken to contain or control the situation and the decisions made.

Report Details

Report prepared by:  
Date:  
What type of personal information is involved?
  • ☐ Personal details such as name and date of birth
  • ☐ Contact information such as home address, phone number or email address
  • ☐ Financial information such as credit card number(s)
  • ☐ NDIS Number
  • ☐ Identifiers such as licence number, Medicare number or Student identifier
  • ☐ Tax File Number
  • ☐ Other – please specify: __________________________
Number of individuals whose personal information is involved in the breach (if known)
  • ☐ 1
  • ☐ 2 – 10
  • ☐ 11 – 50
  • ☐ 51 – 100
  • ☐ Greater than 100
Date of breach
Provide best estimate if the date is unknown		  
Date of discovery
Provide best estimate if exact date is unknown		  

Primary Source of the Breach

  • ☐ Human error
    • ☐ PI sent to the wrong recipient (email)
    • ☐ PI sent to the wrong recipient (mail)
    • ☐ PI sent to the wrong recipient (other)
    • ☐ Failure to use BCC when sending email
    • ☐ Other – please specify: __________________________
  • ☐ Unauthorised disclosed or use
  • ☐ Loss of hardware, documents or data
  • ☐ Insecure disposal
  • ☐ Malicious or criminal attach
    • ☐ Cyber incident (e.g., Phishing, Ransomware, Hacking)
    • ☐ Social engineering/impersonation
    • ☐ Rogue employee/insider threat
  • ☐ Other – please provide details: _______________________
  • ☐ Currently unknown
How did the breach occur (if known)  
Is there a risk of serious harm to individuals affected by the breach? ☐ Yes       ☐ No       ☐ Unsure
Is there a risk to the organisation by the breach? ☐ Yes       ☐ No
Have the affected individuals been notified? ☐ Yes       ☐ No       ☐ Under consideration
What action, including remedial action, has been taken or is intended to be taken to contain and mitigate the impact of the breach?  
What action has been taken, or is it intended to be taken, to prevent a reoccurrence of the breach?  
List any other data protection authorities, law enforcement bodies or regulatory bodies that you have or intend to report this breach to:  
Additional information