Sector
Timeframe for reporting
As soon as practicable if assessed to be an eligible data breach of CDR data.
Type of obligation
Mandatory
Who this applies to
Accredited Data Recipients under the Consumer Data Right.
Description
All data breaches of Consumer Data Right Information fall under the Notifiable Data Breaches scheme, which requires that you notify affected CDR consumers and the Office of the Australian Information Commissioner of eligible data breaches. A breach is eligible if it is likely to result in serious harm to a CDR consumer whose CDR data is involved.
Where a cyber incident lead to a breach of Consumer Data Right information, you must also report to the Australian Signals Directorate’s Australian Cyber Security Centre as soon as practicable once aware of the security incident.