Schedule 1 Amendments (b) one of those other entities has already made an application under paragraph (5)(b) in relation to the eligible data breach of the other entity. Extension of specified period (11) If notice of a paragraph (1)(d) declaration has been given to an entity, the Commissioner may, by written notice given to the entity, extend the period specified in the declaration. Subdivision C—Commissioner may direct entity to notify eligible data breach 26WR Commissioner may direct entity to notify eligible data breach (1) If the Commissioner is aware that there are reasonable grounds to believe that there has been an eligible data breach of an entity, the Commissioner may, by written notice given to the entity, direct the entity to: (a) prepare a statement that complies with subsection (4); and (b) give a copy of the statement to the Commissioner. (2) The direction must also require the entity to: (a) if it is practicable for the entity to notify the contents of the statement to each of the individuals to whom the relevant information relates—take such steps as are reasonable in the circumstances to notify the contents of the statement to each of the individuals to whom the relevant information relates; or (b) if it is practicable for the entity to notify the contents of the statement to each of the individuals who are at risk from the eligible data breach—take such steps as are reasonable in the circumstances to notify the contents of the statement to each of the individuals who are at risk from the eligible data breach; or (c) if neither paragraph (a) nor (b) applies: (i) publish a copy of the statement on the entity’s website (if any); and (ii) take reasonable steps to publicise the contents of the statement. 18 Privacy Amendment (Notifiable Data Breaches) Act 2017 Authorised Version C2017A00012 No. 12, 2017