FREE INITIAL CHECK · NO LOGIN REQUIRED

Find your next step.

Answer five questions for an indicative starting point. No incident descriptions or personal details are needed.

0 of 5 answered

1. Is the organisation covered by the Australian NDB scheme?If you are unsure whether your organisation is covered, choose “Not yet known” and seek advice.

2. Does this involve personal information?Personal information relates to an identified or reasonably identifiable individual.

3. Was information accessed or disclosed without authorisation, or lost where access or disclosure is likely?Include accidental disclosure and loss where unauthorised access or disclosure is likely.

4. Is serious harm likely for any affected individual?Consider serious harm to any individual, including financial, physical, psychological or reputational harm.

How to assess likely serious harm

Consider the circumstances together, from the perspective of a reasonable person in your organisation’s position.

How sensitive is the information, including health, identity and financial details?
Were protections such as encryption effective, or could they be overcome?
Who obtained it, and what could they do with it?
Are any affected people particularly vulnerable?
Could financial, physical, psychological, emotional or reputational harm be serious?
Could combining it with other information increase the risk?

Consider harm to even one person. If evidence is missing, choose “Not yet known” and investigate.

OAIC guidance on serious harm ↗

5. Has remedial action prevented likely serious harm for ALL affected individuals?Choose “No” if likely serious harm remains for even one affected individual.

Your answers stay in page memory unless you choose to keep them for sign-in. Only the five answers are then held in this browser tab for up to one hour; nothing is saved to your account until you confirm after signing in.