Communication strategy

The Director, Communications and Engagement (DCE) has overall responsibility for the communications strategy under this policy, in consultation with the DBRG. NESA aims to notify affected individuals, and external reporting agencies within five business days of an eligible data breach of NESA-held information being reported to the Privacy Commissioner.

Notifications to individuals will have regard to the provisions of Part 6A of the PPIP Act, this policy and NESA’s privacy management plan. Where engagement with external reporting authorities is required, the DCE will consult with other DBRG members and other NESA executive team members, as appropriate. The DCE may consult with other members of the DBRG to prepare and implement appropriate communication and messaging templates for specific purposes, including for cyber security incidents and to enable efficient notification to affected individuals.