Privacy policy states no data-breach notification process
This check reads the privacy policy for a section explaining what the business will do if personal information is breached, for example, who gets notified and how quickly. On this site, a privacy policy is present, but it does not mention any data-breach notification process at all.
Why this matters
Australia's Notifiable Data Breaches scheme, part of the Privacy Act, requires covered organisations to notify eligible breaches, and the GDPR (Articles 33 and 34) sets breach notification duties for organisations it covers. Whether either applies depends on your size, sector and where your customers are, so check with a privacy adviser. A clear breach response section may also reassure buyers and enterprise procurement reviewers.
How to fix it
Your privacy lawyer should add a short 'Data breach response' section stating that affected individuals and the relevant regulator, the OAIC (Office of the Australian Information Commissioner) for Australian businesses, will be notified of eligible breaches, and roughly how that notification will happen. Most privacy policy generators and templates already include ready-made clauses for this, so it's typically about two hours of work.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit