Data Breach Policy

Purpose

Legal Aid Queensland (LAQ) is committed to dealing with personal information in compliance with the Information Privacy Act 2009 (IP Act). Section 73 of the IP Act requires all Queensland government agencies to prepare and publish a data breach policy. This Policy establishes the framework for identifying, managing, and responding to data breaches under the IP Act to:

prepare for, contain, assess, respond and mitigate harm caused by a data breach (including eligible and suspected eligible data breaches)
identify who is responsible for taking what action in response to a data breach
comply with notification requirements for eligible data breaches to the Office of the Information Commissioner (OIC) and particular individuals where required
maintain a register of eligible data breaches.

Applicability

This Policy applies to all LAQ employees including contractors, consultants, volunteers, temporary and casual staff who handle LAQ data, including personal information, sensitive information and confidential data.

Policy requirements

When an LAQ employee becomes aware of a data breach they must comply with this Policy and the Data Breach Response Plan procedure.

A data breach occurs when any information (not limited to personal information) held by LAQ is:

accessed or disclosed without authorisation; or
lost in circumstances where unauthorised access to or disclosure of the information is likely to occur.

Mandatory Notification of Data Breach scheme

To meet LAQ's obligations under the Mandatory Notification of Data Breach (MNDB) scheme in the IP Act, the following steps must be followed in the event of a data breach involving personal information. The Data Breach Response Plan contains further detailed information for employees which must be referred to in conjunction with this Policy.

Step 1 – Identify and report internally

When an employee becomes aware of a data breach or suspected data breach they must:

Immediately report the matter to their Manager and Director and the Right to Information and Privacy Unit within the Corporate Legal Services Team (‘RTI and Privacy Unit’) to enable immediate containment of the breach where possible.
Report the data breach to the RTI and Privacy Unit using the Privacy Breach Report form (PBR) within 3 business days (see the Data Breach Response Plan). The PBR must include details about the personal information involved in the breach and the circumstances surrounding the breach, to inform the mitigation actions and assessment.
If the breach is a suspected cyber incident, it must also immediately be reported to the Information Technology Team and Cyber Security Team.

Step 2 - Contain and mitigate

On receiving information about a data breach, the RTI and Privacy Unit will conduct a preliminary assessment to ascertain the nature and severity of the breach as this will affect how the breach is triaged and escalated.

The RTI and Privacy Unit will make recommendations of any further steps which may be appropriate to contain the breach or reduce its impact and limit any further access or distribution of the affected information. Breach containment and mitigation can often be an ongoing activity throughout the response process.

In the event of a significant data breach LAQ may form the Crisis Activation Team and brief the LAQ Board.

Step 3 - Assess

The RTI and Privacy Unit must determine if the data breach is an eligible data breach or suspected eligible data breach (referred to collectively as ‘eligible data breach’ for the remainder of this Policy) that requires notification to the Information Commissioner, individuals and other agencies under the MNDB scheme in the IP Act.

An eligible data breach occurs when:

there is a data breach involving personal information; and
the data breach is likely to result in serious harm to an individual to whom the personal information relates (an affected individual).

Determining whether a data breach is likely to result in ‘serious harm’ is guided by the factors set out in section 47(2) of the IP Act.

In accordance with the IP Act, the assessment will be conducted as soon as possible but within 30 days, unless LAQ extends the assessment period and provides written notice to the Information Commissioner.

Step 4 - Notify

If the data breach is determined to be an eligible data breach, the Information Commissioner must be notified as required by chapter 3A, part 3, division 2 of the IP Act.

Particular individuals affected by the eligible data breach may also need to be notified in accordance with the IP Act (unless an exemption applies).

If LAQ becomes aware that an eligible data breach may affect another agency, LAQ will give the other agency a written notice of the data breach in accordance with the IP Act.

Step 5 - Post data breach review

Following an eligible data breach LAQ should review and assess whether there is any preventative action available based on the type, nature and seriousness of the breach. This may include a review of technical or administrative systems and processes, staff procedures, and/or training.

LAQ may undertake further investigations to assess how issues were addressed and whether changes to systems, processes, and procedures would mitigate future risks. LAQ may also revise this Data Breach Policy, the Data Breach Response Plan, and the QPP Privacy Policy, if required, in response to the outcome of a post data breach review.

Compiled data breach information is reported periodically to the Audit, Risk and Compliance Committee. This reporting may include de-identified summaries of data breaches on a risk-assessed basis, descriptions of actions taken in response to such breaches, and statistical analysis to identify data breach trends over time.

Register of eligible data breaches

Section 72 of the IP Act requires that an agency keep an internal register of eligible data breaches.

Eligible data breaches and the additional information required by the IP Act must be recorded in LAQ’s Register of Eligible Data Breaches as soon as practicable.

Definitions

Term	Definition
Affected individual	A living individual whose personal information is subject to an eligible data breach
Data breach	Defined in schedule 5 of the IP Act: Unauthorised access to, or unauthorised disclosure of information and/or the loss of information in circumstances where unauthorised access to or disclosure of the information is likely to occur
Eligible data breach	A data breach involving personal information where the unauthorised access or disclosure would be likely to result in serious harm to an affected individual (section 47 of the IP Act)
IP Act	The Information Privacy Act 2009 (Qld)
Personal information	Defined in section 12 of the IP Act: Personal information means information or an opinion about an identified individual or an individual who is reasonably identifiable from the information or opinion: whether the information or opinion is true or not; and whether the information or opinion is recorded in a material form or not.
Serious harm	Harm to an individual can include serious physical, psychological, emotional, financial or reputational harm. The harm must be reasonably likely to result in a real and substantial detrimental effect to the individual. The effect on the individual must be more than mere irritation, annoyance or inconvenience

References

Information Privacy Act 2009
Legal Aid Queensland Act 1997

Policy owner: Chief Corporate Legal Officer

Review period: 3 years or otherwise determined based on risk or emerging risk

Date approved/reviewed: Approved by the LAQ Board on 13 October 2026

Publishing: LAQ website and LINC (LAQ intranet)

Last updated 21 October 2026

Help us improve this site

Yes
Maybe
No

Please provide your website feedback (Maximum 1200 characters)

Comment

If you are seeking legal advice or have a general question for Legal Aid Queensland, please use the general question form or call 1300 65 11 88, Monday to Friday, 8:30am to 4:30pm.