A suspected data breach needs coordinated action, accurate records and appropriate technical and privacy advice. The first day starts the response; it does not replace the investigation or determine every legal obligation.
Establish who is coordinating the response
Use the organisation’s incident plan and identify an authorised lead. Record when the issue was discovered, what is known and who has been contacted. Keep speculation separate from confirmed facts. Use a communication route that is trustworthy if normal accounts may be affected.
The lead should coordinate the technical, business, supplier and privacy decisions. A public checklist cannot determine which live systems should be disconnected or changed. Actions need to suit the incident and preserve the ability to investigate.
Contain harm without destroying useful evidence
Involve the people responsible for the affected service. Appropriate steps may include restricting compromised access or isolating an affected device, but they should be directed by an authorised responder who understands the system. Avoid indiscriminate deletion or repeated changes that obscure what happened.
Preserve relevant logs, messages and a timeline of actions. Record what was changed, by whom and why. Do not move confidential incident records into an unmanaged public tool merely to coordinate quickly.
Assess what information and people may be affected
Identify the systems, information types, possible access and whether the issue is ongoing. Check contractual, insurance and sector-specific requirements alongside privacy obligations. Urgent protective action should not be postponed merely because every fact is not yet known.
For Australian privacy notification questions, use the OAIC’s current Notifiable Data Breaches guidance and obtain advice about whether the scheme applies and what action is required. This article does not assume every business or event has the same notification duties.
Communicate facts through an agreed route
Decide who approves internal and external updates. A useful message distinguishes what is known, what remains uncertain and what people need to do now. Do not speculate about blame or promise a recovery time that has not been established.
Where official cyber reporting is appropriate, use the current ACSC reporting routes. Reporting to one body does not automatically fulfil other notification or contractual requirements.
Prepare a first-day record
Keep an incident reference, discovery time, affected systems, known information, actions taken, contacts, outstanding decisions and the next review time. Assign an owner to each urgent task. Recovery work should validate that systems and information are suitable to return to use.
Read recovery-planning considerations before an emergency and arrange appropriate security support for the actual environment. This guide is general preparedness information, not an assessment of a live incident or legal advice.
