Effective 13 September 2026
Data Breach Response Plan
19 — Data Breach Response Plan
Effective Date: 13 September 2026 Controller: OZ Ride Pty Ltd (ABN 52 694 735 487) and OOHAi Media Pty Ltd as trustee for the OOHAi Media Unit Trust, in respect of Personal Information each controls. Audience: Primarily internal — OZ Ride and OOHAi Media personnel, on-call staff, and engineering. Published here because this framework's rule is that every governance document is version-controlled Markdown with a public URL and a review log (see 00 — Definitions and this framework's architecture notes), not because this document is a consumer-facing notice. Riders, Drivers, and Advertisers are referred to this document from clause 10.1 of the Privacy Policy and clause 4.6 of the Complaints Handling Procedure. Governing law: Commonwealth of Australia (Privacy Act 1988, Part IIIC) and Western Australia. Defined terms: Capitalised terms not defined in this document have the meaning given in 00 — Definitions.
1. Purpose and scope
1.1 This plan implements the Notifiable Data Breaches ("NDB") scheme in Part IIIC of the Privacy Act 1988 (Cth). It sets out what OZ Ride and OOHAi Media personnel must do the moment a suspected data breach is identified, through to closure and post-incident review.
1.2 This plan applies to any suspected unauthorised access to, unauthorised disclosure of, or loss of, Personal Information held by OZ Ride or OOHAi Media — whether the information relates to a Rider, a Driver, an Advertiser, an Advertiser User, or any other individual whose Personal Information the Platform holds. OZ Ride and OOHAi Media both comply in full with the Australian Privacy Principles and the NDB scheme regardless of whether either entity's turnover independently crosses the Privacy Act's ordinary APP-entity threshold — the POLA Act's penalty tiers (up to $50,000,000) and the statutory tort of serious invasion of privacy apply to both entities regardless of that threshold, so this plan's application does not turn on it either way.
1.3 This plan does not itself create any new data-handling practice. It is a response procedure for when something goes wrong with the practices described in the Privacy Policy, the Computer Vision Privacy Disclosure, the Biometric / Facial Verification Notice, and the Data Processing Addendum.
2. What counts as a "suspected eligible breach"
2.1 A suspected data breach is any event, or suspected event, involving:
(a) unauthorised access to Personal Information held by OZ Ride or OOHAi Media; (b) unauthorised disclosure of Personal Information; or (c) loss of Personal Information in circumstances where unauthorised access or disclosure is likely to occur.
2.2 Examples relevant to this Platform: a lost or stolen device containing driver identity documents; a misdirected email containing Rider or Driver Personal Information; a database misconfiguration exposing records publicly; unauthorised access to an administrator account; a third-party processor (Stripe, Twilio, AWS, Cloudflare, RapidID, Deepgram, Sentry, or any other processor named in the Privacy Policy's recipients table) reporting a breach that affects data OZ Ride or OOHAi Media shares with it; a vulnerability report under the coordinated-disclosure channel in clause 2(f) of the Acceptable Use Policy that reveals data was actually accessed (not merely accessible).
2.3 A suspected data breach becomes an eligible data breach — triggering the notification duties in clause 6 — where the breach is likely to result in serious harm to one or more individuals whose Personal Information is involved, and the entity has not been able to prevent that likely risk of serious harm through remedial action (Privacy Act s 26WE).
3. Roles and escalation
3.1 Who must report internally. Any OZ Ride or OOHAi Media personnel, contractor, or Driver who becomes aware of a suspected data breach must report it immediately (not "when convenient", not "once I've confirmed it's real") to:
security@oz-ride.com(rideshare/taxi-side Personal Information), orsecurity@oohai.com.au(advertising-side Personal Information, including Audience Data and any advertiser-tenant data).
3.2 First responder. The first responder logs the report in the internal breach register (clause 8) with a timestamp and opens the assessment clock described in clause 4.
3.3 Founder gate on regulator or public communication. No OZ Ride or OOHAi Media system, script, or automated process may generate, send, or represent as sent any communication to the OAIC, any other regulator, or any affected individual, stating or implying that a breach has been assessed, reported, or resolved. Every external communication about a suspected or eligible data breach — to the OAIC, to any other regulator, to affected individuals, or to the public — requires the founder's (or the founder's expressly delegated Legal & Compliance representative's) personal review and authorisation before it is sent. This is a deliberate control, not an oversight: this Platform has previously found that an automated process can synthesise the appearance of a successful regulator interaction where no interaction in fact occurred, and the response to that finding is that regulator-facing communication about a breach is never automated and never inferred from a "success" flag in a script — it is authorised by a named human being who has read the actual content being sent.
3.4 Engineering and forensics. Engineering personnel assess the technical scope (what data, how many individuals, what systems, whether the exposure is ongoing) and take immediate containment steps (revoking credentials, patching, isolating a compromised system) without waiting for the assessment in clause 4 to complete — containment is not deferred pending legal assessment.
4. The 30-day assessment procedure
4.1 Assessment clock. From the moment a suspected data breach is reported under clause 3.1, OZ Ride or OOHAi Media (as applicable) has 30 calendar days to carry out a reasonable and expeditious assessment of whether the suspected breach is an eligible data breach (Privacy Act s 26WH). The 30-day clock starts on the date of first awareness, not the date the assessment formally begins.
4.2 What the assessment must establish:
(a) what Personal Information was or may have been involved; (b) whether the information was encrypted, tokenised, or otherwise rendered unintelligible to an unauthorised party; (c) who may have obtained the information, and whether they are known to intend misuse; (d) the number of individuals affected; (e) the vulnerability of the affected individuals (for example, whether the information could facilitate identity theft, physical safety risk, or financial harm); (f) the nature of the harm that could result; and (g) whether OZ Ride or OOHAi Media has taken remedial action that would prevent the likelihood of serious harm before the assessment concludes (for example, promptly retrieving or deleting the data before it was accessed).
4.3 Record of assessment. The outcome of every assessment — whether or not it results in a finding of "eligible data breach" — is recorded in the breach register (clause 8), including the reasoning under clause 4.2 and who made the determination.
5. The eligible-breach test
5.1 A data breach is an eligible data breach where a reasonable person would conclude that the access, disclosure, or loss is likely to result in serious harm to any individual to whom the information relates, and the entity has not been able to prevent the likely risk of serious harm through remedial action.
5.2 Factors relevant to "serious harm" include (without limitation): the kind of information involved (biometric and financial information carry a higher inherent risk than, for example, a name alone); whether multiple kinds of information are involved together (a combination is often more sensitive than any one element); the circumstances of the individuals affected; and whether the information is protected by one or more security measures and how difficult those measures would be to overcome.
5.3 Remediation exception. Where remedial action taken before the assessment concludes means serious harm is no longer likely (for example, a lost device is recovered unopened, or a misdirected email is confirmed deleted unread by the recipient before any further disclosure), the breach is not an eligible data breach and the notification duties in clause 6 do not arise. The remediation and the basis for concluding it was effective must still be recorded in the breach register.
6. Notification — what, who, and how
6.1 If the assessment concludes the breach is an eligible data breach, OZ Ride or OOHAi Media (as applicable) must, as soon as practicable:
(a) prepare a statement for the Office of the Australian Information Commissioner (OAIC) under clause 6.2; and (b) notify affected individuals under clause 6.3,
subject in every case to the founder authorisation gate in clause 3.3.
6.2 OAIC statement — required contents (Privacy Act s 26WK):
- the identity and contact details of OZ Ride or OOHAi Media (as applicable);
- a description of the eligible data breach;
- the kind or kinds of information concerned; and
- recommended steps that individuals should take in response to the breach.
6.3 Notifying individuals. Notification to affected individuals must occur as soon as practicable after the statement in clause 6.2 is prepared, using one of the methods the Privacy Act permits: notifying each individual to whom the relevant information relates; notifying only those individuals at risk of serious harm (where practicable to distinguish them); or, if neither is practicable, publishing the statement on the OZ Ride or OOHAi Media website and taking reasonable steps to publicise its contents. The notification to individuals must include the same substantive content as the OAIC statement in clause 6.2.
6.4 Method of contact. Individual notification uses the contact channel already on file for that individual — email for Riders, Drivers, and Advertiser Users; the in-app notification surface where available; and, for a breach affecting Drivers specifically, an in-app message that is also copied to email so it is not missed.
7. Interaction with other obligations
7.1 WA regulatory reporting is independent. Where a suspected or eligible data breach also involves conduct that is separately notifiable to the WA Department of Transport under the Transport (Road Passenger Services) Regulations 2020 (WA) — for example, misuse of a Camera Surveillance Unit recording under regulation 104(g), which is itself a notifiable occurrence with its own 48-hour reporting clock — that regulatory report proceeds on its own timetable and is never delayed pending the NDB assessment in clause 4, or vice versa. The two clocks run independently because they answer different questions to different regulators.
7.2 Contractual notice to processors and Advertisers. Where a breach originates with, or is discovered by, a third-party processor, OZ Ride or OOHAi Media co-ordinates with that processor's own incident-response process while still running the assessment in clause 4 on its own timetable — a processor's slower or faster internal process does not extend or shorten the 30-day clock in clause 4.1.
7.3 Complaints. Where an individual raises what may be a data-breach concern through the Complaints Handling Procedure before OZ Ride or OOHAi Media has independently identified it, the complaint is immediately routed to the process in this document — it is treated as a breach report under clause 3.1, not merely as a complaint to be answered on the complaints timetable.
8. Breach register
8.1 OZ Ride and OOHAi Media each maintain an append-only breach register recording, for every suspected data breach (whether or not it is ultimately found to be an eligible data breach): the date of first awareness; a description of the suspected breach; the assessment outcome and reasoning (clause 4.3); for an eligible data breach, the OAIC statement, the notification method and date, and who authorised the communication under clause 3.3; remedial and containment actions taken; and the post-incident review outcome (clause 9).
8.2 The breach register is retained for the same period as the Audit Log described in clause 8 of the Privacy Policy, and is available to the OAIC on request.
9. Post-incident review
9.1 After an eligible data breach is closed, OZ Ride or OOHAi Media (as applicable) conducts a post-incident review addressing: the root cause; whether existing controls should have prevented it; what control, if any, is being added or changed as a result; and whether the incident reveals a hazard that should be added to, or should trigger a review of, the Safety Management System — for example, an incident involving misuse of Camera Surveillance Unit recordings is both a data-breach matter under this plan and a hazard under that document's hazard register.
9.2 Where the post-incident review identifies a systemic gap (rather than an isolated human error), a corresponding remediation item is raised and owned, so the fix is tracked to completion rather than merely noted in the register.
10. Testing and review
10.1 This plan is reviewed at least annually, and promptly after any actual eligible data breach, any material change to the Platform's data-handling architecture (for example, a new third-party processor, or a new category of Personal Information collected), or any material change to the Privacy Act's NDB scheme.
10.2 Every review is logged with the date, the reviewer, and a summary of any change made — the review log itself is part of the evidence that this plan is being kept current, not just published once and forgotten.
11. Contact
- OZ Ride security / breach reports:
security@oz-ride.com - OOHAi Media security / breach reports:
security@oohai.com.au - Privacy Officer (rideshare/taxi):
privacy@oz-ride.com - Privacy Officer (advertising):
privacy@oohai.com.au - Address: 224 Balcatta Road, Balcatta WA 6021
12. Related documents
- Privacy Policy
- Complaints Handling Procedure
- Computer Vision Privacy Disclosure
- Data Processing Addendum
- Safety Management System
End of Data Breach Response Plan.