Document ID: chunk:federal_register_of_legislation:F2024L01430:reg:3:p2
Version: federal_register_of_legislation:F2024L01430
Segment Type: reg
Provision Reference: reg 3 (pt 2/8)
Character Range: 17860–20565

aware of the incident;
 (iii) the method or source of detection of the incident;
 (iv) the severity of the incident;
 (v) whether the incident has been resolved; and
 (vi) if the incident has been resolved—how it was resolved and how long the entity took to resolve it;
 (f) each digital ID affected by the incident;
 (g) for each individual whose digital ID is affected by the incident:
 (i) if the individual has been informed of the incident—when the individual was informed of the incident; and
 (ii) if the individual has not been informed of the incident—why the individual has not been informed of the incident;
 (h) any relevant identity proofing level and authentication level and, if an individual's digital ID has been re-proofed because of the incident, the date that occurred;
 (i) the measures that the entity has taken and plans to take to deal with the incident, including any action the entity has taken or will take to reduce the risk to the accredited services the entity provides or receives within the Australian Government Digital ID System;
 (j) whether the incident has been referred to an enforcement body or law enforcement agency and, if so, the body or agency to which the incident was referred and the date and time of that referral; and
 (k) if the entity is a participating relying party—the pairwise identifier issued to the relying party in relation to each individual associated with the incident.
 (4) The notification must be made as soon as practicable after, and in any event no later than 1 business day after, the entity becomes aware that an incident has occurred or reasonably suspects an incident has occurred.
 (5) The notification may be given orally. However, if it is given orally, a written notification must be given no later than 3 business days after the oral notification.
 (6) If it is not reasonably practicable for the entity to provide some or all of the information required by subrule (3) (required information) within the period specified in subrule (4) or (5), the entity is taken to comply with subrule (3) if the entity:
 (a) provides an interim notification by the time required by subrule (4) or (5) that includes as much of the required information as is reasonably available to the entity at the time the interim notification is given;
 (b) takes reasonable steps to obtain the outstanding required information as soon as reasonably practicable; and
 (c) provides any outstanding information as soon as reasonably practicable, and in any event within 48 hours of the outstanding information becoming available to the entity.

4.3  Other incidents
 (1) This rule applies to:
 (a) a participating entity; and
 (b) an entity whose approval to