A survey conducted by the Queensland Information Commissioner reveals that Queensland government agencies need to do more to prepare for an upcoming mandatory data breach reporting scheme. The survey received 107 responses from 221 agencies.
Among the respondents, approximately half (52 agencies) reported having a “documented data breach response plan,” although the comprehensiveness of these plans varied. The Information Commissioner’s Office (OIC) clarified that the absence of a plan with that specific title doesn’t necessarily indicate unpreparedness, as agencies may have alternative plans covering data breach response elements under different names.
The OIC emphasized that a documented response plan is just one aspect of a broader framework that should include internal controls and strategies to prevent, detect, and respond to breaches. Lack of a specific plan title does not imply that agencies are neglecting data breach risks or failing to meet their obligations to protect personal information.
The survey identified variations in response plans, including differences in testing procedures. Only 27 out of the 52 agencies with response plans had conducted testing, with 10 agencies conducting cyber security exercises and 12 agencies simulating actual privacy or data breaches.
While most agencies (42 out of 52) had established response teams, only 29 agencies described the roles of team members in their plans, and only 18 agencies provided up-to-date contact details for team members.
The OIC highlighted that all government agencies should be prepared for a future mandatory data breach notification scheme in Queensland, even though such a scheme is not currently in place. The idea for a scheme was endorsed by the state cabinet in mid-last year.
Furthermore, the OIC encouraged agencies to consider publishing information about their data breach response plans in the future to foster community confidence and trust in government operations.
