Data Breach Public Notification Register and Data Breach Policy
The Department of Primary Industries and Regional Development (the department) manages and responds to personal information data breaches in accordance with its Data Breach Policy - Personal Information and publishes notifications of eligible data breaches on this register where required.
Data Breach Policy - Personal Information
The department's Data Breach Policy - Personal Information outlines how the department manages and responds to personal information data breaches and meets its obligations under the Mandatory Notification of Data Breach Scheme.
Read the Data Breach Policy - Personal Information. (PDF 178.28KB)
Why we have a register
If we are unable to notify any of the affected individuals directly, a public notice will be placed on this page.
Part 6A of the Privacy and Personal Information Protection Act 1998 (NSW) introduces the Mandatory Notification of Data Breach (MNDB) Scheme. Under the MNDB scheme, the department must notify the affected individuals of data breaches involving personal or health information that are likely to result in serious harm unless an exemption applies.
When data breaches will be published on this register
The department must provide notification of an eligible data breach as soon as practicable after a data breach has been assessed and after notification exemptions have been considered.
The notification must be available for at least 12 months after the date of publication and include specific legislated information.
Information published in the register
We must record the following details of the eligible data breach on this register:
- data breach title
- date of data breach
- date notification published
- description of data breach
- how the data breach occurred
- type of data breach
- type of personal information that was the subject of the data breach
- amount of time the personal information was disclosed
- actions the department has taken or are planned to take to ensure the personal information is secure, or to control or mitigate the hard done
- recommendations about the steps the individual should take in response to the data breach
- information on how to make a privacy complaint and request an internal review
- agency(s) name that are the subject of the data beach
- contact details for the data breach.