assess-australian-data-breach-l0cka

Assess Australian Data Breach

Prepare a privileged-workstream-ready preliminary assessment for a lawyer. Do not conclude that a breach is notifiable merely because a security incident occurred, and do not delay urgent human escalation while researching.

Read references/breach-assessment-method.md before starting. It defines the fact schema, regime prompts, deadline controls and source rules.

Workflow

1. Escalate and protect.
   • Flag immediate safety, ongoing compromise, destructive activity, material service disruption or an apparently running statutory clock for urgent human attention.
   • Ask only for the minimum de-identified facts. Do not request credentials, live malware, exploit code, unnecessary identifiers or complete datasets.
   • Do not take containment action, contact a threat actor, make a payment, notify a person or regulator, or submit a report. Preserve the lawyer's approval boundary and the forensic evidence-preservation plan.
2. Establish the incident record.
   • Separate known facts, source of each fact, estimates, inferences, assumptions, disputed facts and unknowns.
   • Record detection and awareness times with timezone; suspected occurrence window; systems and custodians; data types and protections; affected and potentially affected people; location; actors; containment/remediation; recipients; vendors; critical services; ransom demand or payment; and existing notices.
   • Do not equate detection, confirmation, containment, assessment completion or occurrence. Record each timestamp independently.
3. Map candidate regimes.
   • Test the Privacy Act Notifiable Data Breaches scheme and each applicable State, Territory, health, critical-infrastructure, cyber-extortion, telecommunications, financial-services or contractual regime.
   • Distinguish mandatory notice, assessment duties, voluntary reports, contractual notice, insurance conditions and internal escalation.
   • Treat numerical thresholds, triggering knowledge standards, recipients, content requirements and time periods as propositions requiring current verification.
   • Invoke $route-australian-privacy-jurisdiction for every State or Territory nexus and $map-australian-cyber-incident-obligations for the concurrent Commonwealth and sectoral matrix.
4. Verify law and calculate cautiously.
   • Invoke $check-commonwealth-legislation for every material Commonwealth title or provision and the relevant incident date. Invoke $check-nsw-legislation for every material NSW title or provision.
   • Invoke $check-australian-privacy-principles when security, retention, use, disclosure or another APP issue is material. Keep this Schedule 1 check separate from verification of the Notifiable Data Breaches scheme. A detected or unverified APP-framework change blocks the APP conclusion, but must not delay urgent containment or independently verified incident duties.
   • Invoke $assess-statutory-privacy-tort independently of APP coverage when intentional or reckless intrusion, surveillance, misuse, disclosure or publication may be material.
   • For another State or Territory, inspect its official legislation source. If a version or commencement point cannot be established, use NOT VERIFIED and escalate the check.
   • Calculate a deadline only after verifying the trigger, period, counting rule and relevant facts. Show the trigger time, timezone, calculation and uncertainty. Never invent a date from an incomplete record.
   • State that case law was not considered. Do not search for or rely on it.
5. Assess and hand off.
   • Address reasonable-likelihood, serious-harm, remedial-action and multi-entity issues only against verified text and stated facts.
   • Build one row per possible obligation. Give the earliest plausible deadline prominence without describing an uncertain date as final.
   • Identify the decision owner, evidence needed and next action. Reserve all notification and legal conclusions for a lawyer and authorised incident lead.