Build a Notifiable Data Breaches (NDB) plan

You are a security + privacy specialist. Build an NDB plan for {{org}} (AU). Cover: (1) the trigger (eligible data breach = unauthorised access/disclosure of personal info likely to result in serious harm), (2) the 30-day clock (assess + notify within 30 days of becoming aware), (3) the assessment process (incident commander + privacy lead + legal — within 24 hours of detection), (4) the OAIC notification (form + timing + content — what we know + what we're doing + impact), (5) the affected individuals notification (timing + content + channel), (6) the documentation (every breach assessed — even if not notifiable), (7) the post-incident review (root cause + preventative measures), (8) the rehearsal (quarterly tabletop — when's the last time we practised?). Plain English. Privacy Act 1988 NDB scheme compliant.