Document ID: chunk:federal_register_of_legislation:C2025C00160:section:25:p1
Version: federal_register_of_legislation:C2025C00160
Segment Type: section
Provision Reference: s 25 (pt 1/2)
Character Range: 51942–54756

25  Suspension of accreditation

Digital ID Regulator must suspend accreditation if Minister's direction about suspension is in force
 (1) The Digital ID Regulator must, in writing, suspend the accreditation of an accredited entity if a direction under subsection 27(1) directing the Digital ID Regulator to do so is in force in relation to the entity.

Digital ID Regulator may decide to suspend accreditation in other circumstances
 (2) The Digital ID Regulator may, in writing, suspend the accreditation of an accredited entity if:
 (a) the Digital ID Regulator reasonably believes that the accredited entity has contravened or is contravening this Act; or
 (b) the Digital ID Regulator reasonably believes that there has been a cyber security incident involving the entity; or
 (c) the Digital ID Regulator reasonably believes that a cyber security incident involving the entity is imminent; or
 (d) if the entity is a body corporate—the entity becomes a Chapter 5 body corporate (within the meaning of the Corporations Act 2001); or
 (e) the Digital ID Regulator is satisfied that it is not appropriate for the entity to be an accredited entity; or
 (f) circumstances specified in the Accreditation Rules apply in relation to the entity.
Note: The Digital ID Regulator may impose conditions on an entity's accreditation before suspending it (see paragraph 17(4)(g)) and can give directions to give effect to a decision to suspend an entity's accreditation (see paragraph 127(1)(b)).
 (3) The reference to cyber security incident in paragraph (2)(b) does not include acts, events or circumstances covered by paragraph (b) or (d) of the definition of that term unless the Digital ID Regulator is satisfied that the attempts referred to in those paragraphs involve an unacceptable risk to the provision of the entity's accredited services.
 (4) In determining whether the Digital ID Regulator is satisfied of the matter in paragraph (2)(e), regard may be had to whether the entity is a fit and proper person.
Note: In having regard to whether an entity is a fit and proper person, the Digital ID Regulator must have regard to any matters specified in the Digital ID Rules and may have regard to any other matters considered relevant (see section 12).
 (5) Subsection (4) does not limit paragraph (2)(e).

Digital ID Regulator may suspend accreditation on application
 (6) The Digital ID Regulator may, on application by an accredited entity, suspend the accreditation of the entity.
Note: See Part 5 of Chapter 9 for matters relating to applications.

Show cause notice must generally be given before decision to suspend
 (7) Before suspending the accreditation of an entity under subsection (2), the Digital ID Regulator must give a written notice (a show cause notice) to the entity.
 (8) The show cause notice