Privacy policy states no data-breach notification process

This check reads the privacy policy for a section explaining what the business will do if personal information is breached, for example, who gets notified and how quickly. On this site, a privacy policy is present, but it does not mention any data-breach notification process at all. Australia's Notifiable Data Breaches scheme, part of the Privacy Act, expects businesses to have and state a breach response process, and the GDPR (General Data Protection Regulation), Articles 33 and 34, requires breach notification for European visitors. Leaving this out is a concrete compliance gap, and it's also a trust signal that buyers and enterprise procurement reviewers specifically look for before doing business with a company. Your privacy lawyer should add a short 'Data breach response' section stating that affected individuals and the relevant regulator, the OAIC (Office of the Australian Information Commissioner) for Australian businesses, will be notified of eligible breaches, and roughly how that notification will happen. Most privacy policy generators and templates already include ready-made clauses for this, so it's typically about two hours of work.