This process is pretty clear already:

https://www.oaic.gov.au/privacy-law/privacy-act/notifiable-data-breaches-scheme

Part 3: Responding to data breaches - four key steps