A data breach is one of the fastest-moving crises an Australian organisation can face. It is both a reputation risk if executed badly, and an opportunity if executed well. Regulatory obligations kick in within 30 days. Customers want answers within hours, sometimes minutes. Journalists may know before you do. And every decision made in the first 24 hours, what to say, to whom, through which channels, shapes both the legal outcome and the reputational one.
Data breach crisis communications is a specialist discipline. It sits at the intersection of legal strategy, regulatory compliance, and public communications. Getting one right without the others is not enough.
The author – Peter Wilkinson
The First 24 Hours After a Data Breach
The first 24 hours of data breach crisis communications are the most consequential, the same golden hour principle that applies to any unfolding crisis. The decisions made, or not made, in this window determine how the event is framed, how regulators respond, and whether the organisation’s response is seen as responsible or evasive.
The moment a data breach is confirmed, or reasonably suspected, four things must happen simultaneously:
- Contain the breach. Work with your IT and cybersecurity team to stop further unauthorised access. Document what happened and when.
- Engage legal counsel. Data breach response in Australia is legally complex. Your lawyers need to be across the situation before any public statement is made.
- Engage crisis communications counsel. Cybersecurity crisis PR is a distinct specialisation. The adviser needs to be aligned with your legal team, not working around them.
- Begin your notification assessment. Under Australia’s Notifiable Data Breach scheme, the clock starts from when you suspect a breach may have occurred, not when it is confirmed.
Data breach response in Australia is not a communications problem with a legal dimension. It is a communications, legal, and regulatory problem that must be managed as one.
Who Needs to Be Told and When
One of the most consequential decisions in data breach crisis communications is sequencing, who is notified, in what order, and through which channel. Getting this wrong creates a second story: that the organisation told the wrong people first, or told some people before others.
| Who | When | Why / Notes |
|---|---|---|
| Your board | Immediately | A data breach is a board-level governance event. The board needs to be informed before any external communication. |
| Your legal team | Immediately | As above. Legal strategy and communications strategy must be developed together from the outset. |
| The OAIC | Within 30 days of becoming aware of an eligible data breach | Required under the Notifiable Data Breach (NDB) scheme. The form is available at oaic.gov.au. If there is a risk of serious harm, notification should be expedited. |
| Affected individuals | Sometimes immediately, or as soon as practicable after notifying OAIC | Required under the NDB scheme if the breach is likely to result in serious harm. The notification must include what happened, what data was affected, and what steps individuals can take. |
| Sector regulators | Depends on your industry | APRA-regulated entities, ASX-listed companies, and health service providers may have additional notification obligations and timelines. |
| Media | Sometimes immediately as a way to reach affected customers. Sometimes, when ready. | Never notify media before regulators and before affected individuals, unless the media is the communications channel. Speak to your customers through the media. Do not speculate. |
What to Say and What Not to Say
The language used in the first statement is the language that defines the event. It is the language journalists quote, regulators remember, and affected individuals share. Cyber breach communications demands precision, not legal hedging, not corporate speak, and not false reassurance. Many of these failures are the same common crisis communication mistakes that turn a manageable incident into a lasting reputational problem.
- Acknowledge that an incident has occurred and that you are investigating.
State clearly what is known and what is not yet known. - Describe what steps the organisation has taken to contain the breach. Be empathetic.
- Tell affected individuals specifically what data was involved. Customers may be anxious.
- Explain what individuals should do to protect themselves.
- Provide a point of contact a dedicated email or phone number for enquiries.
- Do not say “We take your privacy seriously” without specific action behind it, it is now widely recognised as empty language. Same with saying “Sorry” or any other apology.
- Do not speculate on the source of the breach before it is confirmed.
- Do not minimise: avoid phrases like “a small number of records” if the number is not yet known.
- Do not make promises about what will happen that you cannot guarantee.
- Do not issue any statement before it has been reviewed by legal counsel.
Regulatory Obligations Under Australian Law
Australia’s Notifiable Data Breach (NDB) scheme, which operates under the Privacy Act 1988, requires organisations covered by the Act to notify both the OAIC and affected individuals when a data breach is likely to result in serious harm.
- Timeframe: Notify the OAIC as soon as practicable. The legislation anticipates notification within 30 days of becoming aware of an eligible data breach.
- Serious harm test: The NDB scheme applies when a breach is likely to result in serious harm to any individual whose data was involved. “Likely” means more probable than not.
- OAIC notification: Submit a data breach notification form to the OAIC. The form requires a description of the breach, the data involved, and the steps taken in response. This is OAIC communications, it must be accurate, complete, and submitted promptly.
- Individual notification: Affected individuals must be notified directly, by email, letter, or through a prominent notice on the organisation’s website if direct contact is not possible.
- Sector-specific obligations: APRA-regulated entities (banks, insurers, superannuation funds) have additional obligations under the CPS 234 cybersecurity standard. ASX-listed companies may have continuous disclosure obligations. Health service providers are subject to the My Health Records Act.
How Wilkinson Group Helps
Australian organisations weighing up PR agencies for a data breach or cyber incident are really choosing between two things: a generalist agency that assembles a response team after the fact, and a specialist who already has the legal, regulatory and media clocks running in sync. Wilkinson Group is built for the second: one senior counsel coordinating disclosure timing, OAIC notification and public messaging from the first hour, not an account team escalating decisions upward while the story moves without you.
Wilkinson Group provides data breach crisis communications counsel to Australian CEOs, internal PR, boards, and general counsel. When a breach occurs, we work alongside your legal team to develop the communications strategy for regulators, affected individuals, employees, and the media. That is both legally defensible and reputationally sound. For clients who want this counsel already in place before a breach occurs, that ongoing relationship sits inside Wilkinson Confidante.
- Immediate availability. 24/7 when a breach is active.
- Communications strategy aligned with your legal position, including risk assessment.
- Drafting of all external statements, OAIC communications, and individual notifications.
- Media management, including holding statements, spokesperson preparation, and journalist relationship and enquiry management.
- Employee communications: internal briefings to contain information and maintain trust.
- Post-incident reputation management: restoring trust over the months following the event.
Peter Wilkinson has advised Australian organisations through data breaches, cyber incidents, and regulatory investigations since the earliest high profile breach in 2017/8. He spent 30 years as a journalist before moving into crisis PR which means he understands exactly how the media will approach the story, and how to stay ahead of it.
Frequently Asked Questions
Look for an agency who treats data breach communications response as a distinct discipline from a general reputational crisis. It demands fluency working alongside legal counsel on disclosure obligations, the ability to prepare a public statement within hours of confirmation, and experience coordinating regulatory notification with the incident and company messages at the same time.
Under Australia's Notifiable Data Breaches (NDB) scheme, organisations must notify the OAIC as soon as practicable once they become aware of an eligible data breach. The legislation anticipates notification within 30 days. The communications response should not wait for that: the first hours after confirmation, not the 30 day legal deadline, decide whether the organisation controls its story or reacts to it.
It should carry three separate messages, delivered together: the incident message (what happened and the timeline, stated plainly), the company message (what this says about the organisation's values and commitment to fixing it), and the personal message (the leader's own account of how they feel and what they intend to do). Skip the third and it reads as legal cover, however accurate the rest is. This structure is worth building into a wider crisis communication plan well before a breach occurs.
Yes. A data breach response has two clocks running at once: the legal clock (OAIC notification, regulatory disclosure obligations), and the communications clock (staff, media and investors who won't wait for legal sign off before forming an opinion). Wilkinson Group coordinates directly with legal counsel so the two clocks move together, not in sequence.
A data breach carries a defined regulatory disclosure framework under the NDB scheme that managing a general reputational crisis doesn't have. That changes the sequence: legal obligations and reputational needs have to be met in parallel from hour one, not resolved one after the other.
If you are dealing with a data breach right now
Call Peter Wilkinson directly: +61 414 383 433
Available 24/7 · wilkinson-group.com.au
