PLAYCONOMICS

LIONSHEART STUDIOS PTY LIMITED

DATA BREACH RESPONSE PLAN

This Data Breach Response Plan sets out how LionsHeart Studios Pty Limited (ACN 169 410 459), referred to as Lionsheart, we, us, our, identifies, manages and responds to suspected or actual data breaches.

It applies to all personal information handled by Lionsheart in connection with the Product and sets out the procedures we follow to implement the mandatory Notifiable Data Breaches scheme that applies under the Privacy Act 1988.

Definitions

In this Data Breach Response Plan:

  • Data breach means unauthorised access to, or unauthorised disclosure of, personal information or a loss of personal information. Examples of a data breach are when a device containing personal information is lost or stolen, an entity's database containing personal information is hacked or an entity mistakenly provides personal information to the wrong person.
  • Eligible data breach means a data breach where a reasonable person would conclude that the unauthorised access to, unauthorised disclosure of, or loss of personal information is likely to result in serious harm to one or more individuals; and Lionsheart has not been able to prevent the likely risk of serious harm through remedial action – which must be notified in accordance with the Notifiable Data Breaches scheme unless an exception under the Privacy Act applies.
  • Personal information means information or an opinion about an individual who is identified, or who can reasonably be identified, from the information, whether or not the information or opinion is true or recorded in a material form, and includes sensitive information.
  • Sensitive information means information or an opinion that is also personal information, about a person's racial or ethnic origin, political opinions, memberships of political, professional and trade associations and unions, religious and philosophical beliefs, sexual orientation or practices, criminal history, health information, and genetic and biometric information.

Procedure

Identification of a breach

  1. Lionsheart experiences a data breach or a data breach is suspected: this may be discovered by a Lionsheart staff member, or a Lionsheart staff member may be alerted by another party or system.
  2. When a Lionsheart staff member discovers or is alerted to a suspected data breach they must immediately notify Lionsheart Privacy Officer via email at playconomics@lionsheartstudios.com and provide as much information as possible such as the time and date the known or suspected breach was discovered, the type of personal information involved, the cause and extent of the breach, and the context of the impacted information and the breach.
  3. Any immediate steps available to contain the breach must be identified and implemented as a matter of urgency. Reducing the scale and impact of a data breach must be paramount. For instance, where a breach involves credentials, access tokens or accounts, immediate containment measures may include disabling impacted accounts, revoking active sessions or credentials, resetting authentication credentials and restricting impacted system access. All known or suspected data breaches must still be documented internally by Lionsheart.

Assessment of a breach

  1. Not all data breaches are notifiable eligible data breaches. If, after an initial investigation, Lionsheart has reasonable grounds to suspect that an eligible data breach may have occurred, Lionsheart must undertake a reasonable and expeditious assessment to determine whether there are reasonable grounds to believe that an eligible data breach has occurred.
  2. Lionsheart Privacy Officer will review all the information available to assess the suspected breach. In assessing a suspected breach, Lionsheart Privacy Officer may require assistance and information from all its teams to establish the nature and sensitivity of the information impacted, whether the information was encrypted, hashed, de-identified or otherwise protected, the number and type of individuals impacted, the privileges associated with any breached account, whether the breach permits access to other users' information or administrative functions, and the extent to which the breach has been contained.
  3. There will then be an evaluation of the scope and possible impact of the breach. The Lionsheart Privacy Officer will assess whether there are reasonable grounds to believe that an eligible data breach has occurred and ensure appropriate actions including reporting to the OAIC. The assessment must be conducted reasonably and expeditiously, with Lionsheart taking all reasonable steps to complete it within 30 calendar days of becoming aware of the grounds for suspecting that an eligible data breach may have occurred. If the assessment cannot reasonably be completed within that period, the reasons for the delay and the steps taken to complete the assessment must be documented.
  4. In all cases the assessment will identify what actions must be taken. These will be documented and acted upon as soon as possible.
  5. There is no single method of responding to a data breach. Data breaches must be dealt with on a case-by-case basis, by undertaking an assessment of the risks involved, and using that risk assessment to decide the appropriate course of action.
  6. There are four key steps to consider when responding to a breach or suspected breach.
    • STEP 1: Contain the breach and do a preliminary assessment.
    • STEP 2: Evaluate the risks associated with the breach.
    • STEP 3: Notification to OAIC and individuals at risk of serious harm, if required.
    • STEP 4: Prevent future breaches.

A notifiable breach

  1. A breach which is assessed as likely to result in serious harm to individuals whose personal information is involved, is a notifiable data breach. If Lionsheart has reasonable grounds to believe that an eligible data breach has occurred, the Lionsheart Privacy Officer must, as soon as practicable, prepare a statement about the breach and provide it to the OAIC, unless an exception under the Privacy Act applies.
  2. The statement must include Lionsheart’s identity and contact details; a description of the eligible data breach; the particular kind or kinds of information involved; and recommendations about the steps individuals should take in response to the breach.
  3. After preparing the statement, Lionsheart must take reasonable steps to notify individuals of its contents. Depending on what is practicable, Lionsheart may notify all individuals to whom the affected information relates; or only those individuals who are likely to be at risk of serious harm.
  4. If neither form of direct notification is practicable, Lionsheart must publish a copy of the statement on its website and take reasonable steps to publicise its contents.
  5. If Lionsheart takes remedial action that prevents the data breach from being likely to result in serious harm, the breach will not be a notifiable data breach and notification will not be required. The remedial action and the reasons for the decision not to notify must be documented.
  6. The Lionsheart Privacy Officer is responsible for coordinating any notification to the OAIC and affected individuals and for ensuring that all assessment, notification and decision-making records are retained.
  7. Notifications will follow the format identified by the OAIC in Data breach preparation and response.

Response team

A response team will be formed for a serious breach. The team will include all senior Lionsheart staff members and the Lionsheart Privacy Officer, as well as a legal team that will provide legal advice and compliance.

Breaches that are not eligible data breaches

Breaches that are not assessed as eligible data breaches may be handled by the senior Lionsheart staff members but must be reported to the Lionsheart Privacy Officer.

Records

Documentation will be stored by Lionsheart electronically for each suspected breach.

Questions?

You may want to contact us to ask a question about our Data Breach Response Plan, or alert us about a potential data breach. You may do so by:

  • Email: playconomics@lionsheartstudios.com
  • Mail: Playconomics @ School of Economics, UNSW Business School, UNSW Sydney Kensington 2052 NSW Australia
  • Telephone: +61 2 9385 7480

Effective September 2023

Updated September 2026