Data Breach Report

Detects populated data breach reports and assessments under the Commonwealth Notifiable Data Breaches (NDB) scheme (Privacy Act 1988 Part IIIC): breach report / notification / assessment titles together with populated breach record fields (entity, dates, individuals affected, information involved, incident reference). The Queensland mandatory notification of data breach scheme (IPA 2009 Chapter 3A) is out of scope and will be a separate classifier.

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

Medium: breach report titles also appear in OAIC guidance, templates and news, so enforcement requires populated breach record fields; 85 adds NDB-scheme evidence that the primary does not itself match.

Jurisdictions

au

Regulations

Privacy Act 1988 (Cth), NDB Scheme (Cth)

Frameworks

ISO 27001

Data categories

security, privacy, legal

Scope

narrow

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:data\s+breach\s+(?:report|notification|assessment)|privacy\s+(?:breach|incident)\s+(?:report|assessment)|notifiable\s+data\s+breach|ndb\s+(?:assessment|notification))\b

Should match

• Notifiable data breach assessment Entity: Harbour Freight Pty Ltd Date of discovery: 03/09/2026 Individuals affected: 12,480 Information involved: names, dates of birth, driver licence numbers The entity has reasonable grounds to believe an eligible data breach occurred; a statement will be lodged with the OAIC under section 26WK. — 85 - populated NDB assessment with entity, dates, affected count and serious-harm/OAIC evidence
• Data breach report - privacy team Incident reference: PB-2026-118 Date of breach: 28/08/2026 Containment: supplier credentials revoked. — 75 - populated breach record fields without NDB-scheme evidence
• Notifiable data breach report: OAIC notification issued to affected individuals. — 65 discovery - title and scheme words, no populated record fields
• Data breach assessment: eligible data breach with serious harm evaluation — 65 discovery - assessment title without populated fields

Should not match

• Breach of contract claim — Non-data breach usage
• The dam breach caused flooding — Non-data breach usage
• The OAIC guide explains when a notifiable data breach must be reported and what a statement to the Commissioner should contain. — Regulator guidance naming the scheme - no populated breach record (65 at most)
• Data breach report form Entity: ________ Date of discovery: ________ Individuals affected: [number] Information involved: [describe] — Blank report template - placeholder fields are rejected
• Retailer lodges notifiable data breach notification after 1.2 million customer records were exposed, the OAIC confirmed on Tuesday. — News report - no populated record fields
• Sample template for notifying the privacy regulator after personal information exposure. — Adjacent template language is not a populated breach record
• Security incident report: forensic analysis and containment completed. — Sibling cyber-report language does not satisfy the data-breach primary

Known false positives

• Non-data breach uses of breach. Mitigation: Require data-specific breach terms like NDB, OAIC, or affected individuals.

References

• OAIC - Notifiable data breaches
• OAIC - About the Notifiable Data Breaches scheme
• Privacy Act 1988 (Cth)