Notifiable Data Breaches

1. Our commitment

360 SaaS Pty Ltd (ABN 79 681 731 340) holds sensitive practice and client information, including tax file numbers. We take responsibility for protecting it, and if something goes wrong we tell the right people quickly and plainly. This page explains how we handle a data breach under the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act 1988 (Cth).

2. What counts as an eligible data breach

An eligible data breach happens when both of these are true:

• There has been unauthorised access to, unauthorised disclosure of, or loss of personal information that we hold, in circumstances where unauthorised access or disclosure is likely to follow.
• A reasonable person would conclude the breach is likely to result in serious harm to one or more of the individuals the information is about.

Serious harm can be physical, psychological, emotional, financial or reputational. We consider the kind and sensitivity of the information (tax file numbers, identity documents and financial details are high risk), whether it was protected, who may have obtained it, and what they could do with it.

A breach is not notifiable if we take remedial action that prevents the likely serious harm before it occurs. In that case we still record what happened and what we did.

3. What we do when a breach is suspected

Our Notifiable Data Breach procedure is part of our ISO/IEC 27001 information security management system. It runs in five steps.

• Report and log. Every team member must report a suspected breach to security@ or privacy@ immediately, and in any case within one hour of noticing it. The report is logged and a response lead is assigned.
• Contain. We act straight away to stop the breach continuing: disabling accounts or keys, isolating systems, revoking access and recovering or blocking exposed data. We preserve evidence as we go.
• Assess. The Chief Privacy Officer leads an assessment of whether there are reasonable grounds to believe an eligible data breach has occurred. We aim to finish within 72 hours. The law allows a maximum of 30 days, and we never use that time as a reason to delay when the facts are already clear.
• Notify. If we believe an eligible data breach has occurred, we prepare a statement and notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable. We also notify the customers (practices) whose data is involved, and other parties we are required to inform.
• Review and improve. Within 10 business days of closing the incident we hold a post-incident review, fix the root cause, update our risk register and controls, and record the lessons learned.

4. Who we tell, and when

• Our customers (practices): within 24 hours of confirming that a breach affects their data, as set out in our Data Processing Agreement, so they can meet their own obligations.
• The OAIC: as soon as practicable after we form the belief that an eligible data breach has occurred, using the OAIC's notification form.
• Affected individuals: as soon as practicable after the OAIC statement is prepared, directly by email or phone where we can, or otherwise by publishing a statement on this website.
• The Australian Taxation Office: where the breach involves the ATO integration or tax data, in line with the ATO Digital Service Provider requirements.
• Other parties: payment, identity-verification and other suppliers where our agreements with them require it, and law enforcement or the Australian Cyber Security Centre where a crime is suspected.

If we hold the information jointly with a customer, the law allows one party to notify on behalf of both. We agree with the customer who will notify, and we make sure notification happens.

5. What a notification contains

Every notification to the OAIC or to individuals includes:

• Our identity and contact details (360 SaaS Pty Ltd, ABN 79 681 731 340).
• A description of the breach.
• The kinds of information involved.
• The steps we recommend individuals take to reduce the risk of harm.

6. The Chief Privacy Officer

Privacy is a named accountability at Portal 360, not an afterthought. We appoint a Chief Privacy Officer (CPO) who is responsible for how we handle personal information and for our response to any data breach.

The CPO:

• owns this procedure and the privacy and data breach records, and keeps them current;
• leads the assessment of every suspected breach and recommends to the Director whether it is notifiable;
• is the contact for the OAIC and for privacy complaints and access or correction requests;
• advises the business on privacy impact assessments for new features, suppliers and uses of AI;
• runs privacy awareness training for the team and tests our response through scenario exercises;
• reports to the Director on privacy risk, incidents and improvements at least quarterly, and to management review of the ISMS.

To keep decisions independent, the CPO has direct access to the Director and external legal counsel, and a notification decision is approved by the Director on the CPO's recommendation. We keep breach assessments, decisions and notifications for at least seven years.

You can contact the Chief Privacy Officer at privacy@portal360.ai.

7. Roles in a breach response

• Chief Privacy Officer: leads the assessment, prepares the statement, keeps the register and is the contact for the OAIC.
• Director: approves every notification and external statement, and provides resources.
• Technical Lead: contains the breach, preserves evidence and investigates the cause.
• Support Lead: manages communication with affected customers and individuals.
• External legal counsel and forensic specialists: engaged for serious or complex breaches.

8. If you may be affected

If we tell you your information was involved in a breach, you can reduce your risk by:

• changing your Portal 360 password and any other account that shares it, and turning on multi-factor authentication;
• being alert to unexpected emails, calls and texts that mention your details, and not clicking links you did not expect;
• checking your bank, tax and myGov accounts for activity you do not recognise;
• contacting IDCARE, Australia and New Zealand's national identity and cyber support service, on 1800 595 160 or at idcare.org, if you think your identity has been misused;
• asking a credit reporting body to place a ban on your credit file if your identity documents were exposed.

You can complain to us at any time. If you are not satisfied with our response, you can contact the OAIC on 1300 363 992 or at oaic.gov.au.

9. How to report a suspected breach

If you think you have found a data breach, a vulnerability or a misdirected message, email security@portal360.ai or privacy@portal360.ai straight away. Tell us what you saw and when, and do not share the information further. We acknowledge reports within one business day. Customers can also contact our support team at support@portal360.ai.

10. Past notifications

We publish a statement here for any eligible data breach where we cannot contact individuals directly. There are no current notices.