SPECIMEN. Invented organisation, invented plan, for testing only.
# Tamarind Lane Physiotherapy: Data Breach Response Plan (DBRP), version 2

DBRP-1 Contain first: reset credentials, end sessions, remove rules.
DBRP-2 Assess against the Privacy Act Part IIIC and record the reasons in the breach register.
DBRP-3 The privacy officer (the director) decides on and lodges every statement to the Commissioner and approves every notice to individuals. The response assistant drafts them.
DBRP-4 Clients are contacted by the method the clinic normally uses with them (SMS to the mobile on file, or email).