General information, not legal advice. This guide summarises the scheme in broad terms. Whether it applies to your practice, and what you must do after a particular incident, are questions for your own legal adviser and your insurer.
Why legal practices are a target
A practice's files can include identity documents, health and financial records, family law matters and commercially sensitive deals. Conveyancing and settlement work moves large sums through trust accounts. Attackers know this. The most common attacks are not sophisticated. A phished password, a mailbox without MFA or an unpatched laptop is often the way in.
The Notifiable Data Breaches scheme in brief
The Notifiable Data Breaches (NDB) scheme sits in Part IIIC of the Privacy Act 1988 and is administered by the Office of the Australian Information Commissioner (OAIC). It applies to organisations covered by the Privacy Act. Generally that means businesses with an annual turnover above $3 million, plus some smaller businesses in particular circumstances. Check with your adviser whether your practice is covered.
In general terms, an eligible data breach happens when:
- personal information is accessed or disclosed without authorisation, or is lost in circumstances where that is likely to happen;
- a reasonable person would conclude this is likely to result in serious harm to one or more of the individuals involved; and
- the organisation has not been able to prevent the likely risk of serious harm through remedial action.
If you suspect an eligible data breach, the scheme generally requires a reasonable and prompt assessment, completed within 30 days. If the breach is eligible, you generally must notify the OAIC and the affected individuals as soon as practicable. Acting fast to contain a breach can sometimes stop it from becoming notifiable, which is one more reason the first hours matter.
Your professional obligations and your insurance policy may carry their own reporting requirements. Many policies expect prompt notice of an incident, so read yours before you need it.
What an incident response plan should cover
The OAIC's guidance describes four broad steps: contain, assess, notify and review. A useful plan turns those into names, numbers and decisions made in advance. It should cover:
- Who leads. A named person who coordinates the response, with a deputy for when they are away.
- Who to call. Your IT provider, your insurer's incident line, your bank, your legal adviser on privacy, and your principal or board.
- How to contain. Who can lock accounts, isolate devices and stop payments, and how to reach them out of hours.
- How to preserve evidence. Logs and affected devices should be kept for investigation rather than wiped in a hurry.
- How to assess. Who decides whether serious harm is likely, using what information, and how that decision is recorded.
- How to communicate. Templates for notifying clients and the OAIC, and a rule that nobody discusses the incident outside the response team.
- How to review. What changed afterwards so the same thing does not happen twice.
Test the plan once a year with a short tabletop exercise. Pick a scenario, such as a compromised conveyancer's mailbox two days before settlement, and walk through who does what.
The first hours
- Stop money first. If funds may have gone to a fraudulent account, call your bank immediately and ask for a recall. Delay makes recovery less likely.
- Contain without destroying evidence. Disconnect affected devices from the network rather than wiping them. Reset passwords for compromised accounts and sign them out of every session.
- Check the mailbox. Look for forwarding rules, inbox rules and sent items the user did not create. Attackers use these to watch and to hide replies.
- Start a written timeline. Record what was noticed, when, by whom, and every action taken. You will need it for any assessment and for your insurer.
- Call your insurer's incident line early, as your policy requires.
- Report the cybercrime. The Australian Cyber Security Centre accepts reports through ReportCyber at cyber.gov.au.
- Begin the assessment. Work out what information was involved, whose it was and whether serious harm is likely. Get advice on whether notification is required.
How we help
Preparation is most of the work. Every Legal MSP client gets the same baseline: MFA enforced through Conditional Access, legacy authentication blocked, Defender for Endpoint P2 on every managed device, encrypted laptops that can be wiped remotely, and Microsoft 365 backup held outside the tenant with scheduled restore tests. It is mapped to the Essential Eight.
- 24/7 SOC triage. A human security operations centre looks at alerts around the clock, weekends included, and can contain an affected device.
- Containment. Our engineers lock accounts, revoke sessions and remove attacker changes such as mail forwarding rules.
- Recovery from backup. Files and mailboxes come back from copies held outside your tenant. Laptops are rebuilt through Windows Autopilot.
- The facts, in writing. We give you a timeline of what happened and what was done, drawn from the logs and your documentation register. You and your advisers make the legal assessment. We supply accurate technical facts.
- A plan that fits. We can help you draft the technical sections of your incident response plan and run a tabletop exercise.
For more on the controls, see cyber security for legal practices, email security and payment-redirection fraud and backup and incident recovery.