36Take steps to mitigate data breach

36 Take steps to mitigate data breach

(1) If a data scheme entity reasonably suspects or becomes aware that a data breach of the entity has occurred, the entity must, within the period applicable under subsection (3), take reasonable steps to prevent or reduce any harm resulting from the breach to entities, groups of entities and things to which the data involved in the breach relates.

Civil penalty: 300 penalty units.

(2) If: (a) a data custodian reasonably suspects or becomes aware that a data breach of an accredited entity has occurred; and (b) the data breach involves scheme data that is output, or ADSP‑enhanced data, of a project in which the data custodian shared public sector data with or through the accredited entity; the data custodian must, within the period applicable under subsection (3), take reasonable steps to prevent or reduce any harm resulting from the breach to entities, groups of entities and things to which the data involved in the breach relates.

Civil penalty: 300 penalty units.

(3) The period for taking the steps is: (a) the period applicable under a data code; or (b) if there is no period applicable under a data code—as soon as practicable after the breach occurs.