What is a data breach notification letter?
It is a formal letter informing people, or a regulator, that their personal information may have been exposed in a security incident, along with what the company is doing about it.
Data, Privacy & Compliance
Data Breach Notification Letter
Generate a data breach notification letter for customers, employees or the OAIC, aligned with the Notifiable Data Breaches scheme under the Privacy Act 1988.
- Create a customer data breach notification letter
Create a data breach notification letter from [Company Name] to affected customers, explaining what personal information was involved in the breach and what steps are being taken, consistent with the Notifiable Data Breaches scheme.
- Create a regulator data breach notification letter
Create a data breach notification letter from [Company Name] to the Office of the Australian Information Commissioner (OAIC), reporting an eligible data breach affecting [Number] individuals and the company's response.
- Create an employee data breach notification letter
Create a data breach notification letter from [Company Name] to affected employees, explaining what personal information was exposed and what support is being offered.
Data Breach Notification Letter Generator (Australia)
A data breach notification letter formally informs people, or a regulator, that their personal information may have been exposed in a security incident, along with what the company is doing about it. This free Australian generator produces letters to customers, to the Office of the Australian Information Commissioner (OAIC), and to employees, reflecting the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988, which requires notification where an eligible data breach is likely to result in serious harm to affected individuals. It is designed for Australian businesses responding to a suspected or confirmed data breach who need to notify quickly and in the right format for each audience. The generator lets you describe what happened, what data was involved, remediation steps, and support offered to those affected. Use it to help meet your NDB obligations while communicating clearly with affected people.
Frequently asked questions
Who needs to be notified after a data breach in Australia?
Under the Notifiable Data Breaches scheme, businesses must notify affected individuals and the OAIC where a breach is an "eligible data breach" likely to result in serious harm.
What should a customer notification letter include?
It should explain what happened, what personal information was involved, what the company is doing in response, and what steps the customer can take to protect themselves.
How is an OAIC notification different from a customer letter?
An OAIC notification (a statement under the NDB scheme) is more detailed and technical, covering the nature of the breach, the kinds of information involved, and the recommended steps for individuals.
How quickly must a breach be reported in Australia?
Businesses must notify as soon as practicable after becoming aware an eligible data breach has occurred, and there is no fixed statutory deadline like 72 hours, but delay is treated unfavourably by the OAIC.
Should employees be notified the same way as customers?
Employee data breaches are generally treated in the same way as customer breaches under the NDB scheme, but the letter may also need to reference internal HR support and reporting channels.