59XExemption for compromised cyber security

#### 59X Exemption for compromised cyber security 59X Exemption for compromised cyber security > > (1) The head of a public sector agency may decide to exempt the agency from Division 3, Subdivision 3 for an eligible data breach if the head of the agency reasonably believes notification would— > > > > > (a) worsen the agency’s cyber security, or > > > > > (b) lead to further data breaches. > > > (2) The head of the agency must have regard to the guidelines, prepared by the Privacy Commissioner, in making a decision to exempt the agency under this section. > > > (3) The head of the agency must, by written notice given to the Privacy Commissioner, notify the Privacy Commissioner— > > > > > (a) that the exemption under this section is relied on, and > > > > > (b) when the exemption is expected to end, and > > > > > (c) of the way in which the agency will review the exemption. > > > (4) The head of the agency must— > > > > > (a) review the use of the exemption each month, and > > > > > (b) provide an update to the Privacy Commissioner on the review of the exemption. > > > (5) The exemption applies only for the period of time the head of the agency reasonably believes the notification would— > > > > > (a) worsen the agency’s cyber security, or > > > > > (b) lead to further data breaches. > > **s 59X:** Ins 2022 No 74, Sch 1\[11\].