Data breach policy

    On this page

    PURPOSE

    The Information Privacy Act 2009 (Qld) (IP Act), and the Queensland Privacy Principles (QPPs), set rules for how the Board of Professional Engineers of Queensland (BPEQ) must handle personal information.

    The IP Act contains additional rules for how BPEQ must deal with data breaches, including those involving personal information that are assessed as being 'eligible data breaches'.

    The purpose of this Data Breach Policy (Policy) to is to outline:

    • how BPEQ will respond to data breaches in accordance with the Mandatory Notification of Data Breach (MNDB) Scheme under the IP Act; and
    • the roles and responsibilities within BPEQ for reporting data breaches and strategies for containing, mitigating, assessing and managing eligible data breaches.

    SCOPE

    This Policy applies to all BPEQ Board members, staff and contractors.

    WHAT IS A DATA BREACH?

    A 'data breach' is defined under the IP Act and means either of the following in relation to information held by BPEQ:

    • unauthorised access to, or unauthorised disclosure of, personal or non-personal information; or
    • the loss if personal or non-personal information in circumstances where unauthorised access to, or unauthorised disclosure of the information is likely to occur.

    A data breach may involve any personal or non-personal information held by BPEQ. However, this Policy (and our obligations under the MNDB Scheme) focuses on how BPEQ will respond to data breaches involving personal information.

    What is 'unauthorised access' or 'unauthorised disclosure' to information?

    Access or disclosure to information will be unauthorised if it happens without proper permission, licence, or legitimate purpose (whether intentionally or unintentionally).

    What is loss of information?

    Loss of personal information means where BPEQ loses possession or control of that personal information. Loss may occur because of a deliberate or accidental act or omission of BPEQ.

    A data breach can be caused in various ways, including by malicious actions of third parties or BPEQ employees, human error or a failure in information handling or security systems. Where a data breach impacts a large number of individuals or third parties, and/or any impacted individuals may be seriously harmed, then it may be classified as significant and require further consideration in relation to how to respond to the breach.

    A data breach may occur internally within BPEQ (for example an employee accessing personal information on an unauthorised basis), or involve the disclosure of personal information externally, by BPEQ or its contractors.

    All data breaches, require assessment against the requirements of the MNDB Scheme to determine if the data breach has triggered these requirements.

    Individuals may lodge a privacy complaint if they believe BPEQ has breached its obligations under the IP Act, including the QPPs.  It is therefore important that BPEQ's response to a potential or actual data breach is timely, consistent, effective, and appropriate.

    What is an eligible data breach?

    The MNDB Scheme established under the IP Act requires BPEQ to notify an affected individual/s, and the Information Commissioner, of any data breach that is likely to result in serious harm to an individual (eligible data breach).

    Under the IP Act, an eligible data breach will have occurred if:

    • there has been unauthorised access to, unauthorised disclosure of, or loss of, personal information held by BPEQ; AND
    • the access, disclosure or loss is likely to result in serious harm to any of the individuals to whom the information relates.

    An eligible data breach may occur internally within BPEQ or involve the unauthorised access and/or disclosure of personal information by, or to, external parties, including threat actors or contractors. For example, the following kinds of data breaches may constitute eligible data breaches:

    • a cyberattack, phishing, malware, or hacking incident into BPEQ's database allowing access by external parties; or
    • a contractor disclosing sensitive personal information to external parties; or
    • an online internal database or portal is accidentally made publicly available; or
    • unauthorised accesses by a BPEQ employee or individual to a restricted internal file containing sensitive personal information; or
    • a BPEQ employee accidently losing or misplacing documents containing sensitive or personal information.

    BPEQ also holds tax file number (TFNs). If the eligible data breach involves TFNs then BPEQ must comply with the requirements under the Privacy Act which involves referral to the Australian Information Commissioner and affected individuals in accordance with the Privacy Act.

    What is serious harm?

    “Serious harm” is defined under the IP Act to include:

    • serious physical, psychological, emotional, financial, or reputational harm to the individual because of the access or disclosure; or
    • serious harm to the individual's reputation because of the access or disclosure.

    The effect on an individual must be more than mere irritation, annoyance, or inconvenience. Examples of serious harm include:

    • identity theft;
    • financial loss;
    • threats to personal safety;
    • loss of business or employment opportunities;
    • humiliation and embarrassment;
    • damage to reputation or relationships; and
    • discrimination, bullying, or other forms of disadvantage or exclusion.

    For any data breach, the risk of harm should be assessed having regard to the:

    • likelihood of the harm eventuating for individuals whose personal information was part of the breach; and
    • the consequences of the harm.

    The IP Act includes a list of matters that may assist BPEQ in assessing the likelihood of serious harm arising, including:

    • the persons, or kinds of persons, who have obtained, or who could obtain, the personal information;
    • the nature of the harm likely to result from the data breach;
    • the kind of personal information accessed, disclosed or lost;
    • the sensitivity of the personal information;
    • the persons who have or could obtain the personal information;
    • whether information is protected by security measures, and the likelihood that these could be overcome; and
    • any other relevant matters.

    Some other factors or issues that may be relevant in assessing serious harm include:

    • the circumstances of the individuals affected and their vulnerability or susceptibility to harm (that is, if any individuals are at heightened risk of harm or have decreased capacity to protect themselves from harm);
    • the circumstances in which the breach occurred, for example, a third party has obtained access to the personal information; and
    • actions BPEQ may have taken to reduce the risk of harm following the data breach.

    Roles and responsibilities for managing data breaches

    The Chairperson is ultimately responsible for BPEQ's compliance with the IP Act, including the MNDB Scheme. The Corporate Services Manager manages BPEQ's privacy function.

    BPEQ employees have a responsibility to ensure that personal information handled in the performance of their duties is managed in accordance with the IP Act. BPEQ employees have a responsibility to identify, escalate and investigate data breaches. They should consult internal procedures for detailed guidance on responding to a data breach in accordance with this Policy.

    A high-level overview of relevant responsibilities within BPEQ is outlined below.

    employeeResponsibilities
    BPEQ employees
    • handle personal information consistently with the IP Act and this Policy; and
    • identify and immediately report actual or suspected data breaches involving personal information to the Corporate Services Manager in accordance with this Policy.
    Business area impacted by breach
    • collaborate with the Corporate Services Manager to take containment and mitigation action (immediately and on an ongoing basis as needed);
    • undertake additional internal escalation reporting as needed (e.g. Legal, Compliance and Investigations Unit);
    • provide information for assessment and internal reporting;
    • engage with any service providers (if needed); and
    • implement permanent prevention methods (if needed).
    ChairpersonNotify the Information Commissioner, affected persons and others. Publishing, monitoring and reviewing the currency of public notifications of data breaches published under section 53(1) of the IP Act.
    Corporate Services Manager
    • collaborate with business area on containment and mitigation;
    • undertake / recommend additional internal escalation/ reporting as needed (e.g. Legal, Compliance and Investigations Unit);
    • assess severity of data breaches, including those involving personal information and the likelihood a breach will result in serious harm to an individual (eligible data breach); and
    • maintain BPEQ's register of eligible data breaches.
    Data  Breach Response Team (if needed)The team assembled by BPEQ to manage a serious actual or suspected data breach. The team's composition will change depending on the type of data breach. Its responsibilities will include formalising data breach risk assessments, briefing requirements, containment and mitigation actions, investigations, resourcing, communications strategy, correspondence, and preventative actions.
    Senior Registrations and Information Management Officer

    Assist the Corporate Services Manager with the responsibilities above.

    BPEQ's systems and processes

    BPEQ implements a range of systems and processes for mitigating and managing data breaches. These include:

    • ensuring the accuracy of privacy collection notices;
    • conducting privacy impact assessments;
    • information asset audits and information sharing agreement reviews;
    • information security management systems, system security reviews, access controls and privileges;
    • training and awareness programs for BPEQ employees regarding the risks associated with data breaches and their responsibilities in identifying, responding, reporting and preventing such incidents;
    • arrangements for third-party providers who store personal information on behalf of BPEQ so that third-party providers are aware of the MNDB Scheme and the obligations under this Policy to report any data breaches to BPEQ;
    • implementing key learnings from a data breach incident to ensure that BPEQ's systems, policies and procedures are fit for purpose and that appropriate preventative measures are in place; and
    • BPEQ promotes active communication between internal teams to effectively and accurately respond to data breach incidents. This includes a high level of cooperation between the Corporate Services Manager and other managers.

    Data breach response process

    While all data breaches are different and therefore will require a different response, BPEQ has a procedure to deal with data breaches.

    BPEQ employees must respond to a data beach in accordance with the Data Breach Response Plan.

    The key steps required in responding to a data breach are as follows:

    • Initial report an triage;
    • Administration;
    • Containment;
    • Assessment;
    • Notification;
    • Complaints Management;
    • Remediation;
    • Review;
    • Maintaining records.

    Each step is set out in further detail in the below table.

    StepNameDescription
    OneInitial report and triage

    BPEQ employees to immediately contact the Corporate Services Manager when becoming aware that a data breach may have occurred and provide information.

    Any report to the Corporate Services Manager should include details about the data breach, including the nature of the information subject to the breach such as personal information and circumstances surrounding the data breach to inform containment/ mitigation actions and assessment.

    TwoAdministration

    This stage involves the appropriate allocation and escalation of the matter. This includes setting up a Data Breach Response Team, which may involve engaging and managing external experts.

    The Data Breach Response Team will establish a proactive and reactive communication strategy and consider any immediate notifications.

    ThreeContainment

    The Data Breach Response Team will coordinate the following:

    • take all reasonable steps to immediately contain the breach;
    • mitigate any possible damage to BPEQ and/or affected individuals; and
    • stop the breach from occurring again.

    The above may involve:

    • making efforts to recover the personal information;
    • securing, restricting access to, or shutting down breached systems;
    • suspending the activity that led to the data breach; and
    • revoking or changing access codes or passwords.

    In determining the appropriate containment or mitigation actions, the Data Breach Response Team should consider the following questions:

    • what happened to cause the data breach, and can interim controls be implemented?
    • Does BPEQ need to work with any third parties or service providers to investigate and resolve the data breach?
    • Can the personal information be recovered?
    • Can the personal who has received personal information incorrectly, be contacted?
    • Can the system which has been breached be shut down?

    This stage may also involve communications with other parties if they are involved in the containment of a data breach. The Corporate Services Manager will also be responsible for coordinating any internal advice and assistance, such as, for example, assistance from BPEQ's shared services provider (Corporate Administration Agency) or cyber security unit in containing and mitigating the data breach.

    FourAssessment

    Undertake a fulsome assessment of the breach to determine if it is an eligible data breach. This will involve an assessment of the severity of the breach and the likelihood that the breach will result in serious harm to an individual to whom the information relates. This assessment must be completed within 30 days of forming a reasonable suspicion of a data breach. If BPEQ is satisfied that it will not be able to complete the assessment in 30 days, it can extend that time under section 49 of the IP Act.

    The following matters should be considered when assessing the breach:

    • What is the nature of the breach?
    • Is a counterparty or other third party likely to have caused the breach?
    • How serious is the breach? What type of personal information is involved?
    • Who is affected by the breach and what is the likelihood of serious harm to the affected individuals? Is there an eligible data breach? If so, should any notifications occur?
    • Has the breach affected another agency?
    • Should BPEQ contact any other internal or external subject matter experts (e.g. technical investigators or auditors or Legal, Compliance and Investigations)?
    • What steps should be taken by the agency to minimize or avoid any potential harm to individuals?
    FiveNotification

    If BPEQ reasonably believes that there has been an eligible data breach, it must, as soon as practicable:

    • Prepare a statement about the eligible data breach in accordance with section 51 and provide that statement to the Information Commissioner;
    • If one of the exemptions apply BPEQ may not be required to comply with the notifications requirements. See Division 3 of the MNDB Scheme;
    • Notify affected individuals about the eligible data breach as soon as reasonably practicable; and
    • Provide further information to the Information Commissioner.

    BPEQ may also be required to notify the Australian Information Commissioner under the Privacy Act if the data breach includes TFNs.

    Notification to individuals will be determined by a harm and risk assessment. If there is a foreseeable risk of harm, notification should occur unless the notification is likely to cause more harm than it would alleviate. It is critical to document the decision-making process here (including an assessment of impacted human rights).

    The method of notifying affected individuals/organisations will depend in large part on the type and scale of the breach, as well as immediately practical issues such as having contact details for the affected individuals/organisations. Considerations include the following:

    • When to notify: Individuals/organisations affected by a data breach will be notified as soon as practicable. However, practical factors are also recognised. It is best to avoid premature notifications before BPEQ has sufficient information. This is because, if not enough information is known, general letters with little information may cause unnecessary harm, panic, and concern.
    • How to notify: BPEQ will take reasonable steps to notify each individual or each affected individual directly – by telephone, letter, email or in person. If BPEQ cannot directly notify each individual or each affected individual, it will publish the required information on BPEQ's website for a period of at least 12 months, in accordance with section 53(1)(c) of the IP Act.
    • What to include: Sections 51(2) and 53(2) of the IP Act set out the specific information that a notification to the information commissioner and individual/s must include, to the extent it is reasonably practicable:
      • the date that the breach occurred, how the breach occurred and a description of the type of eligible data breach (e.g. access, disclosure or loss), including the number of people impacted by the data breach;
      • the personal information included in the breach;
      • the amount of time the personal information was disclosed for;
      • actions that have been taken or are planned to secure the information, or to control and mitigate the harm;
      • recommendations about the steps an individual should take in response to the breach;
      • information about complaints and reviews of agency conduct;
      • the name of the agencies that were subject to the breach;
      • contact details for the agency subject to the breach or the nominated person to contact about the breach; and
      • the number of people who will be notified about the data breach and whether those people have been advised of their rights to make a privacy complaint to the agency.

    In this stage, BPEQ will also consider:

    • other legal obligations requiring notification of a breach outside of the IP Act; or
    • for non-eligible data breaches, BPEQ may in its discretion consider voluntary data breach notification to the Information Commissioner, affected individuals and others.
    SixComplaints Management

    BPEQ will develop a complaint response strategy for privacy complaints. Please refer to section 9 Complaints in BPEQ's Privacy Policy for information about how to make a complaint about a privacy breach.

    SevenRemediation

    To understand what BPEQ needs to do to remediate the breach, it may need to obtain expert advice to consider the following:

    • the steps required to resolve the incident;
    • the reasonableness of what happened;
    • what changes/controls will prevent or reduce risk of reoccurrence; and
    • costs associated with remediation.

    This stage may involve third party engagement.

    EightReview

    BPEQ is committed to implementing key learnings from a data breach incident to ensure that BPEQ's systems, policies and procedures are fit for purpose and that appropriate preventative measures are in place.

    As part of preventing future breaches, BPEQ should consider the following questions to take the following actions:

    • Can BPEQ provide training to its employees?
    • What was the root cause of the data breach?
    • Can BPEQ update its existing internal processes?
    • Does BPEQ's internal register of eligible data breaches illustrate any reoccurring issues?

    Can BPEQ permanently implement any of the interim containment or mitigation actions taken in response to the breach?

    NineMaintaining records

    BPEQ will:

    • Keep records of the data breach, including the assessment about whether a data breach is an eligible data breach, consistent with BPEQ's obligations to maintain public records in accordance with the Public Records Act 2023;
    • Maintain an internal register of any eligible data breaches in accordance with section 72 of the IP Act.

    BPEQ holds personal information securely and takes reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure.

    APPROVAL

    This policy was approved by the Board Chair on 27 August 2025.