Breaching Boundaries: Improving Data Breach Notifications in Australia

Abstract

This report presents the findings from an ARC-funded research project examining organisational data breach disclosure practices in Australia. The research sought to understand how organisations navigate the increasingly important and challenging areas of information security, privacy, data breaches, and breach disclosure and notification. We conducted in-depth, semi-structured interviews with 50 senior personnel from organisations including large for-profit entities, key not-for-profits and government agencies at both a state and federal level. We interviewed senior executives and personnel working in information security, privacy, cybersecurity, data management, risk, and compliance roles. In this report we present ten key findings from our interview analysis. For each finding we suggest recommendation(s) that, if implemented, support an improved disclosure regime and can help guide organisational best practice as data breach notification assessments are made.