At 7.30am on a Tuesday, the director of a recruitment agency answers the phone to a client who has just received an email from a competitor quoting, almost word for word, the pricing proposal the agency sent two weeks earlier. The agency's account manager resigned the previous Friday. When the director checks the laptop logs, she finds the manager emailed the client database to her personal address the night she resigned.
The immediate problem looks like employee misconduct, but three separate legal issues are running at once. The employee owes the business a duty of confidence, which exists both as a term of the employment contract and as an equitable obligation the courts will enforce. If the leaked material includes personal information about clients, candidates or staff, the Privacy Act 1988 (Cth) may require you to investigate and, in some cases, notify the Office of the Australian Information Commissioner (OAIC). And the way you respond can create a fourth problem: a claim against the business for unfair dismissal or breach of contract if you discipline or terminate the employee without a proper process.
The stakes are real. A client database or pricing list is often the most valuable asset a small business owns, and once it has been handed to a competitor it cannot be handed back. Your client contracts may give clients a right to claim damages from you for the leak. If personal information is involved, you are under a statutory deadline to assess whether you must notify. And every step you take now, from preserving evidence to interviewing the employee, will be scrutinised later if the dispute ends up in court or before the Fair Work Commission. The five steps below set out the order in which a sensible business owner should move.
Five steps to take now
1. Preserve the evidence before you touch anything
Your first move should be to lock down the information trail, not to confront anyone. Ask your IT person to disable the employee's access to accounts, email, file shares and cloud storage, and to do it in a way that does not delete or alter anything. A wiped laptop or a cleaned-up mailbox destroys the evidence you will need for any claim against the employee, and it can look deliberate if the dispute reaches court.
Gather, in their original form:
- Access logs: who logged in, when, and from which device or location.
- Email records: forwarding rules, messages sent to personal addresses, and any mail sent to external accounts.
- File activity: downloads, copies to USB drives, uploads to cloud services, and print jobs.
- Contracts and policies: the employment contract, any confidentiality agreement, and the IT and social media policies the employee signed or acknowledged.
- Witness accounts: anything colleagues noticed, recorded at the time rather than reconstructed later.
Two cautions. Do not let anyone tidy up the employee's devices before you have reviewed them, and do not tell the employee you are investigating until the records are secured, or they may delete the rest. If you are thinking of using surveillance, such as CCTV footage or monitoring software, as evidence, check the law first. In New South Wales, the Workplace Surveillance Act 2005 (NSW) requires written notice at least 14 days before surveillance of an employee begins, and notice to a new employee before they start work. Other states have their own rules, so take advice on what monitoring is lawful where you operate.
2. Work out what was taken and who is exposed
Before you can decide what to do, you need to know the shape of the leak. Work through the preserved records and answer three questions:
- What: was it business information such as pricing, client lists, tender documents and trade secrets, or personal information such as names, addresses, dates of birth, bank details and health information of clients, candidates or staff?
- Where: did it go to a personal email address, a USB drive, a personal device, or directly to a competitor?
- Who: how many individuals are affected, and what could the information plausibly be used for?
The distinction between business information and personal information matters because it decides which legal regimes apply. Business information is protected through the employee's duty of confidence and your contracts. Personal information attracts the Privacy Act 1988 (Cth). Most leaks involve a mix of both. This step and step three run in parallel, so if any personal information is involved, start step three at the same time as you finish mapping the leak.
3. Check your notification obligations under the data breach scheme
If the leak includes personal information, work out whether your business is covered by the Privacy Act as an APP entity. Under s 6D of the Act, a business is generally exempt as a small business operator if its annual turnover for the previous financial year was $3 million or less. The exemption does not apply if the business provides a health service and holds health information, discloses personal information for a benefit, service or advantage, or is a contracted service provider for a Commonwealth contract. Businesses above the $3 million turnover line are covered as a matter of course.
If you are an APP entity, Part IIIC of the Act sets up a notification scheme for eligible data breaches. An eligible data breach occurs under s 26WE when there is unauthorised access to, unauthorised disclosure of, or loss of personal information, and a reasonable person would conclude that there is a likely risk of serious harm to any of the affected individuals. Section 26WG points to the factors that go into that assessment: the kind and sensitivity of the information, the security measures protecting it, whether those measures could be overcome, and who has obtained or could obtain the information. If you can take remedial action that removes the likely risk of serious harm before it eventuates, s 26WF says the incident is not an eligible data breach.
The obligations then follow a timeline:
- Suspected breach: if you suspect an eligible data breach but are not yet sure, s 26WH requires a reasonable and expeditious assessment, completed within 30 days of becoming aware.
- Believed breach: if you have reasonable grounds to believe an eligible data breach has occurred, s 26WK requires you to prepare a statement setting out what happened, the kinds of information involved and recommended steps for affected individuals, and give it to the OAIC as soon as practicable.
- Notify individuals: under s 26WL, you must also notify each affected individual, or those at risk, or publish the statement on your website if notification is impracticable.
The Commissioner can also direct you to notify. Missing these steps is a separate regulatory problem on top of the leak itself, so if there is any doubt about whether the test is met, take advice before the 30 day window runs.
4. Deal with your clients and prepare your claims against the employee
Once the immediate investigation is under way, turn to the two civil fronts: what your clients can claim from you, and what you can claim from the employee.
Your client contracts will commonly contain confidentiality provisions. If the leaked information included a client's confidential information, your client may argue that you breached the contract and claim damages for business lost as a result. Even without a written clause, obligations may be implied into the relationship. Review your contracts, be transparent with affected clients about what happened, and take advice before making any admission about liability.
Against the employee you have two overlapping claims: breach of the employment contract, and breach of confidence, an equitable obligation that applies whether or not the contract says anything about confidentiality. The orthodox test asks whether the information had the necessary quality of confidence, whether it was received in circumstances importing an obligation of confidence, and whether it was used without authorisation.
Courts move quickly when confidential information is at stake. In Jackson Power Real Estate Pty Ltd v Jones [2024] NSWSC 1665, a real estate agency that had paid about $880,000 for a rent roll obtained an injunction against a former employee who had joined a competitor. The court restrained her from soliciting the agency's clients and from communicating its confidential information, and ordered her to deliver up the information and disclose who had received it. An urgent injunction of that kind is often worth more to a business than damages, because it stops the damage from continuing. A letter of demand warning of such an application can sometimes secure the return of the information and a signed undertaking without going to court.
5. Investigate, then discipline, with a fair process
Only after you have preserved the evidence and understood the scope should you turn to the employee. The natural instinct is to terminate immediately, but that can turn a leak into an unfair dismissal claim of your own.
A defensible process looks like this:
- Suspend, don't dismiss: a short suspension on full pay while you investigate is usually sensible and keeps the relationship intact pending the outcome.
- Put the allegations in writing: tell the employee exactly what conduct is alleged and provide the key evidence.
- Give them a chance to respond: an opportunity to explain before any decision is made is a legal requirement, not a courtesy.
- Consider the response: weigh what they say, including any explanation that the disclosure was accidental or authorised.
- Decide and document: if you terminate, have a valid reason and record the reasoning and the process.
Under the Fair Work Act 2009 (Cth), a dismissal can be challenged as unfair if there was no valid reason or the employee was not given a fair process. Leaking confidential information can be a valid reason for dismissal, including summary dismissal for serious misconduct, but only where the conduct is established and the process is fair. Take advice before you terminate: the cost of the advice is a fraction of the cost of defending a claim.
When to bring in a lawyer
Some of these steps you can manage yourself, but there are points where professional help is worth the money. If you brought this situation to Artificer Legal, a practitioner would typically start by reviewing the preserved evidence and mapping which legal regimes apply, then:
- advise on whether the incident is an eligible data breach and, if so, draft the statement to the OAIC and the notifications to affected individuals within the 30 day assessment window;
- review your client contracts and employment agreements to assess your exposure and the strength of your claims against the employee;
- write a letter of demand to the employee, or to the competitor if they are knowingly holding the information;
- apply urgently to a court for an injunction and delivery up orders if the information is in the hands of a competitor;
- run the disciplinary process with you so that any termination withstands a challenge in the Fair Work Commission.
Seek advice early if the leak involves client or customer personal information, if you think a competitor holds the information, or if a client has already raised a claim.
The response, not the leak, decides your exposure
The idea to hold onto tomorrow is this: the leak itself is rarely the most expensive part of the problem. The most expensive part is usually the response. Evidence destroyed by a hasty IT cleanup, a termination rushed through without a fair process, or a notification deadline missed because nobody checked the Privacy Act, each of those turns one leak into a separate claim against the business. A leak handled calmly, in the order set out above, is a dispute you control. A leak handled in a panic is a dispute that controls you.
In summary: preserve the evidence first and check your surveillance law before monitoring anyone; map what was taken and whether personal information is involved; if you are an APP entity, assess suspected data breaches within 30 days and notify the OAIC and affected individuals where there is a likely risk of serious harm; review your client contracts and be ready to claim against the employee for breach of contract and breach of confidence, including urgent injunctions; and investigate with a fair process before you discipline or terminate. If any of those questions are hard to answer, that is the moment to take advice.