Schedule 1 Part 7 (Part IIIC Division 5) lets the Minister make an eligible data breach declaration to prevent or reduce a risk of harm from misuse of information after an eligible data breach. While one is in force, an entity may collect, use or disclose personal information about an individual only if it reasonably believes the individual may be at risk from the breach, the handling is for a permitted purpose specified in the declaration, the information is of a specified kind, it is disclosed by and to specified entities or classes, and any conditions are met; an agency's officer or employee is covered only if authorised by the agency. Handling within those terms does not breach an APP, a registered APP code or a TFN rule, and gives protection from secrecy (other than designated secrecy provisions) and confidence claims. Nothing requires an entity to collect, use or disclose.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.