Data Breach Response Plan for Tax Practices

A data breach response plan tells your practice who acts when client information is exposed. Contain the breach immediately, keep the evidence and assess the risk to clients. Notify the required parties when the serious-harm test is met.

What to Do in the First 24 Hours

Stop ongoing access as soon as you discover a suspected breach. For an unknown mailbox sign-in, work through these steps while your technical contact preserves the evidence.

1. Reset the affected password from a trusted device. End active sessions and revoke suspicious access permissions. Disconnect an affected device from the network if it could keep exposing information.
2. Preserve sign-in logs, mailbox rules, message records and relevant files. Record what you change and when. Do not delete the compromised mailbox or wipe devices before your technical contact keeps the evidence.
3. Open an incident log with the discovery time, affected account, reporter and immediate actions. Store it somewhere the compromised account cannot reach.
4. Brief the principal or deputy. Assign a response lead and contact your IT provider for containment help.
5. Notify your cyber insurer or professional indemnity insurer promptly under your policy’s terms. Record its instructions, including any requirement to use an appointed incident provider.
6. Contact the ATO early if TFNs, ATO access or refund details are involved. Protective action on client accounts can start while the privacy assessment continues.

The OAIC’s response guidance supports immediate containment without destroying evidence. Containment, assessment and notification can overlap when clients need urgent protective advice.

Ask the technical contact to confirm that further unauthorised access has stopped. A password change alone does not prove this if active sessions or malicious mailbox rules remain. If messages redirected payments, use the business email compromise response alongside this plan.

When a Breach is a Notifiable Data Breach

A notifiable data breach is an eligible breach under the Notifiable Data Breaches (NDB) scheme in the Privacy Act 1988. The OAIC’s reporting test requires all these conditions.

• Personal information was accessed or disclosed without authority, or lost in circumstances where unauthorised access or disclosure is likely.
• Serious harm to at least one affected individual is likely.
• Remedial action has not prevented that likely serious harm.

TFNs paired with identity details, copies of identity documents and bank details can enable identity theft or refund fraud. These exposures often warrant a serious-harm finding, particularly when an attacker obtains several identifiers together. The decision still depends on the actual information, who obtained it and what effective remedial action remains possible.

The scheme generally covers businesses with annual turnover above $3 million and businesses covered through an exception to the small-business exemption. A TFN recipient is covered for TFN information even if otherwise exempt. Establish your practice’s coverage against the OAIC’s entity guidance. Other exceptions can apply to a small practice.

These hypothetical incidents show how the decision changes with the evidence.

Incident	Evidence to establish	Likely decision on those facts
One return emailed to the wrong recipient	The return contains a TFN. The recipient is known, confirms deletion immediately and provides credible evidence of no copying or further disclosure.	Effective remedial action can remove likely serious harm. Record why the recipient’s account is reliable before deciding notification is unnecessary.
Stolen unencrypted laptop	It holds readable returns and ID copies. The practice cannot recover it or establish that the information stayed inaccessible.	Assess likely identity and financial harm. Unprotected identifying records and an unknown recipient support an eligible-breach finding.
Compromised mailbox holding many TFNs	Logs show an attacker downloaded attachments containing TFNs and matching identities. Ending access cannot retrieve the copies.	Likely serious harm remains. Notify under the NDB scheme and contact the ATO for protective action.

A small number of clients does not rule out serious harm. Conversely, an unusual sign-in location alone does not establish that an attacker obtained client records. Preserve the evidence that resolves that question.

Assessing a Suspected Breach

Assess a suspected breach promptly by identifying the affected information and deciding whether serious harm remains likely. Section 26WH requires all reasonable steps to complete the assessment within 30 calendar days after awareness of grounds for suspicion. The OAIC expects a much shorter assessment where possible.

1. Gather the facts. Record the access window, affected accounts, known downloads and evidence still needed from providers. Assign a person to obtain each missing record.
2. Identify the clients and information. List document types and identifiers against affected clients in a restricted assessment file. Avoid copying full TFNs into the incident log.
3. Judge likely harm. Consider how the recipient could use the information, any encryption and whether the recipient could defeat it.
4. Test remedial action. Establish what was recovered or made unusable. Document why those actions remove likely serious harm, or why they leave it possible.
5. Record the decision. Name the decision-maker, evidence relied on, reasons, notification actions and next review point.

Once reasonable grounds establish an eligible breach, start notification without waiting for the assessment period to expire. If the assessment takes longer, document the reasonable steps taken and the reasons for delay.

For a decision that a breach is not notifiable, record the failed condition explicitly. For example, a credible recipient confirmation and supporting evidence might establish that deletion prevented likely serious harm. Reopen the decision if later evidence shows the return was forwarded first.

Check Each Place Client Information Travelled

An AI-assisted client form can leave information in several places. Assess each location separately instead of treating the form and its outputs as one exposure.

Location	Assessment question
Form answers	Which answers could the unauthorised account read?
Uploaded documents	Which attachments were opened or downloaded, and what identifying information did they contain?
AI review inputs	What information actually reached the review, and could the affected account access it?
Emails	What appeared in message text, attachments and forwarded copies?
Exports and generated documents	Which files existed outside the form, and who could retrieve them?
Staff TFN reveals	Which staff accounts revealed TFNs during the affected period?

Tax Genie removes every TFN before AI review and excludes TFNs from emails, exports and generated documents. TFNs stay hidden until staff reveal them, and every reveal is logged. Use those records and the TFN handling details to trace actual access. Assess other client information and uploaded documents separately.

A logged reveal records an account’s action. It does not establish that the person using a compromised account was authorised. Obtain the relevant records and reconcile them with sign-in evidence before reaching the breach decision.

Dark web monitoring can supply evidence that records were offered for sale. An absence of results does not establish that information was never copied or that serious harm is unlikely.

Notifying the OAIC, Clients, the ATO and the TPB

Notify the OAIC and individuals at risk as soon as practicable once you have reasonable grounds to believe an eligible breach occurred. Each other contact has its own purpose and reporting rules.

OAIC Statement and Client Notices

Prepare the statement with your practice’s identity and contact details, a description of the breach, the kinds of information involved and recommended protective steps. Submit it through the OAIC’s Notifiable Data Breach form.

The OAIC’s notification guidance allows notice to every affected individual or only those at risk of serious harm. If neither direct option is practicable, publish the statement on your website and take reasonable steps to publicise it. Keep personal information out of that public statement.

Use this outline for each client notice. Fill it from the assessment so the advice matches that client’s exposure.

1. Identify the practice and a working contact number or safe reply channel.
2. Explain what happened and the period of exposure. Distinguish confirmed access from what is still being assessed.
3. Name the actual information involved, such as a TFN, passport copy or bank account details. Avoid sending the exposed identifiers again.
4. Explain the containment and protective action already taken.
5. Give practical next steps for that information, such as contacting the bank, changing affected passwords or following ATO identity-protection instructions.
6. State how the client can ask questions and how further material information will reach them.

ATO Protective Action

Phone the ATO’s Client Identity Support Centre on 1800 467 033 as soon as possible. The ATO’s data breach guidance for tax professionals identifies this channel and protective measures for client accounts.

Explain the affected practice account, information types, access window and known signs of unauthorised lodgements or changed refund details. Ask how to provide the affected-client list securely. Keep the ATO reference number and instructions in the incident log.

The ATO can apply protective measures and may contact affected clients directly. Account monitoring or additional identity safeguards depend on the exposure and the ATO’s response. Follow its instructions and warn clients about fraudulent contact that uses their stolen information.

TPB Confidentiality and Breach Reporting

Code item 6 requires permission or a legal duty before disclosing information about a client’s affairs. The TPB’s NDB guidance says the OAIC administers the scheme. Incompetent or reckless IT handling that causes a confidentiality breach can affect registration.

Separately, the TPB’s breach-reporting rules require a report when you have reasonable grounds to believe a significant Code breach occurred. A cyber incident needs that separate assessment. The TPB notice period is within 30 days of first having, or being expected to have, those grounds.

Use My Profile’s Agent reports section for a mandatory significant-breach report. Assess any recognised professional association reporting requirement when reporting another practitioner. Record the Code test and reasons even when you conclude that mandatory reporting is not triggered. The full Code guide explains the wider duties.

Data Breach Response Plan Template

Complete this data breach response plan template before an incident and keep an accessible copy outside your everyday mailbox. Adapt the roles to your practice and use the OAIC’s plan guidance to check coverage.

Purpose

Define the information this plan covers and the events that activate it. Include mistaken disclosure, lost records and suspected unauthorised access. State how staff report a concern without waiting for proof.

Response Team and Contacts

Record the response lead (usually the principal) and a deputy who can approve action when the lead is absent. Name the technical contact and the person handling client calls. One person can fill several roles, but each responsibility needs an available backup.

Complete this contact sheet with verified details and an offline copy.

Contact	Details to record	When to use it
IT provider	Incident number, after-hours number and authorised contact	Containment and preserved technical evidence
Cyber or PI insurer	Claims number, policy reference and notice terms	Immediate policy notice and provider instructions
ATO Client Identity Support Centre	1800 467 033, practice caller and secure-list instructions	TFN, ATO access or refund exposure
OAIC	Notifiable Data Breach form route and assigned preparer	Eligible-breach statement
Practice’s bank	Verified fraud number and authorised caller	Practice banking exposure or payment fraud
TPB	My Profile access and assigned Code assessor	Significant-Code-breach assessment and report

Containment Steps

Name who can suspend access, revoke sessions and disconnect devices. Require the technical contact to preserve logs and files before destructive cleanup. Include the check that confirms ongoing exposure has stopped.

Assessment Method

Use a restricted affected-client list and evidence file. Record awareness of suspicion, the assessment owner and the 30-day assessment period. Apply the NDB test and document the effect of remedial action.

Notification Decisions

Keep separate decisions for the OAIC, clients, ATO, TPB and insurer. Record the deciding facts, action owner, required timing and completion reference for each.

Client Communication

Keep an approved notice outline and a safe contact channel. Name who approves notices, answers calls and updates clients when new facts change their protective action.

ATO Contact

Assign the caller and deputy. Describe how they identify affected clients without sending a TFN list through the compromised mailbox. Store the ATO’s protective instructions and reference number.

Records and Review

Set the location and access permissions for the incident log, evidence, decisions and notices. Record who kept each item and any provider retention limit. Schedule a review and assign unfinished improvements to named roles.

This breach playbook sits inside your wider incident response plan. Keep privacy assessment and exposure containment here. Hand compromised-system remediation, ransomware recovery and safe service restoration to the wider plan, with the preserved evidence and outstanding privacy actions.

After the Breach: Review and Prevention

Hold a review within a few weeks and assign fixes to the cause of the breach. Compare the incident log with what staff actually did. Update the plan when a contact, authority or evidence source failed.

Common follow-up actions include stopping TFNs in email, enabling multi-factor sign-in, removing access staff no longer need and deleting ID copies whose retention purpose has ended. Preserve incident evidence and meet required retention duties before deleting anything. Use the cyber security guide for the wider prevention work.

Test the plan at least annually with a discussion-based exercise. ASD’s Exercise in a Box describes tabletop exercises that test decisions without affecting real systems. The following fictional exercise scripts let a small practice test this breach playbook.

Run the Exercise

Assign a facilitator who introduces evidence and keeps a decision record. The principal acts as response lead, the technical contact assesses access and the client-contact role drafts notices. Include the deputy and make the principal unavailable for the opening stage.

Give one piece of evidence at a time. Ask participants to activate the plan, decide containment and preserve records before showing the next piece. Draft contact actions only. Do not change live systems or send real notices.

Scenario 1: Return Sent to the Wrong Recipient

First reveal that a return containing a TFN went to an unintended recipient. Ask the team to identify the client, contact the recipient through a safe channel and preserve the sent message.

Then reveal that the known recipient confirms deletion and no forwarding, with evidence supporting that account. Ask the team to record whether effective remedial action removed likely serious harm.

Finally, change the evidence: the recipient forwarded the attachment before deleting it. The hypothetical answer changes. Identify the onward recipient and reassess harm because deletion of the first copy no longer resolves the exposure.

Scenario 2: Unexplained Mailbox Access

Start with an unusual sign-in alert and a mailbox holding TFN attachments. The team must reach the deputy and request sign-in and download records while ending unauthorised access.

Next, reveal downloads of returns for twelve clients by the compromised account. Each return pairs a TFN with identity details. Have the team identify those twelve clients from the evidence.

The fictional answer is that serious harm remains likely when an attacker keeps those files. Draft the OAIC statement and client protective advice, contact actions for the ATO and insurer, and a separate TPB Code assessment.

Scenario 3: Ransomware and Possible Copied Files

Reveal that several devices show a ransom demand. Ask the team to isolate affected access and preserve evidence through its technical contact. Activate the wider technical recovery plan.

Next, reveal a claim that client files were copied. A threat alone needs investigation. Ask what access records and file samples would establish the affected information.

Finally, reveal a verified sample of stolen client ID records and TFNs. The fictional answer is to assess likely serious harm and notify when eligible-breach grounds are established. Recovery from backups does not remove exposure of copied records. Hand technical restoration to the wider incident team while privacy actions continue.

Record Observable Results

Use the exercise record to check whether the deputy was reached, affected clients were identified and evidence survived the proposed containment actions. Require a reasoned NDB decision and a draft contact action for each relevant party.

Record each gap with its owner, correction and retest point. Repeat the failed part after the correction so the practice can demonstrate the changed decision or action before closing it.