The first steps
- Contain the breach to prevent further compromise.
- Phone the ATO Client Identity Support Centre on 1800 467 033.
- Tell affected clients and staff.
- Contact your software provider.
- Remove access people no longer need.
Facts and sources for this part
- The OAIC's four steps after a breach are: contain it, assess it, notify if required, and review it to prevent future breaches. [S21]
- After a breach, phone the ATO Client Identity Support Centre on 1800 467 033 so protective measures can be put on client accounts, tell affected clients and staff, contact your software provider, secure your systems and remove access people no longer need. [S11]
Is it notifiable?
A breach is an eligible data breach when there is unauthorised access or disclosure, it is likely to cause serious harm, and remedial action has not prevented that harm. Likely means more probable than not. Tax practitioners are covered for breaches that involve TFN information.
Facts and sources for this part
- A breach is an eligible data breach when there is unauthorised access or disclosure (or loss), it is likely to cause serious harm to someone the information is about, and remedial action has not prevented that likely harm. [S20]
- Likely means more probable than not. Whether serious harm is likely is judged from the viewpoint of a reasonable person in the entity's position. [S19]
- Tax practitioners who hold tax file number information are covered by the Notifiable Data Breaches scheme for breaches that involve TFN information. [S23] [S35]
How fast
The Commissioner expects an assessment to take no longer than 30 days, and much less where possible. If notification is required, you tell the people at risk and the Commissioner as soon as practicable, using the OAIC online form.
Facts and sources for this part
- The Commissioner expects an assessment of a suspected breach to take no longer than 30 days, and much less where possible. [S19]
- When a breach is eligible, you must notify the people at risk of serious harm and give a statement to the Commissioner as soon as practicable. You use the OAIC's online Notifiable Data Breach form. [S19] [S20]
Your TPB duty
Separately, you must notify the TPB within 30 days if you have reasonable grounds to believe there has been a significant breach of the Code.
Facts and sources for this part
- You must tell the TPB within 30 days if you have reasonable grounds to believe there has been a significant breach of the Code. A breach is significant if, for example, it results or is likely to result in material loss or damage to another entity. [S9]
Signs of a breach
- Lodgments on client accounts that you did not make.
- Changes to client files that you did not make.
- Not being able to log in, or account verification emails deleted.
- Devices behaving differently.
Facts and sources for this part
- Signs of a breach include lodgments on client accounts you did not make, changes to client files you did not make, being unable to log in or finding account verification emails deleted, and devices running abnormally. [S11]
What it can look like
In one ATO case a laptop and documents were stolen from a tax agent's car, and the agent's identity was then used to lodge fraudulent PAYG summaries on clients' accounts.
Facts and sources for this part
- In one ATO case, a laptop and documents were stolen from a tax agent's car. The agent's own identity was then used to lodge fraudulent PAYG summaries on their clients' accounts. [S11]
Learn it before you need it
The course walks through a breach step by step, with questions.