Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p2
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 2/21)
Character Range: 35206–38184

if accredited must be operational.
 (3) The applicant must, at the time it applies for accreditation, have conducted:
 (a) assurance assessments in accordance with Chapter 3;
 (b) systems testing in accordance with Chapter 3;
 (c) a privacy impact assessment in accordance with rule 2.4;
 (d) technical testing in accordance with rule 2.5;
 (e) if the applicant will conduct biometric binding if accredited—biometric testing in accordance with the Accreditation Data Standards;
 (f) a cyber security risk assessment in accordance with rule 4.7; and
 (g) a fraud risk assessment in accordance with rule 4.25.

2.4  Privacy impact assessment
 (1) The applicant must, at the time it applies for accreditation, have conducted a privacy impact assessment in accordance with this rule.
 (2) The privacy impact assessment must:
 (a) assess the privacy impacts of:
 (i) the applicant's DI data environment and the boundaries of that environment as identified, defined, documented and limited in accordance with rule 2.1; and
 (ii) the applicant's proposed accredited services;
 (b) be conducted by a person who:
 (i) has appropriate experience, training and qualifications to conduct a privacy impact assessment;
 (ii) is external to the applicant and, if the applicant is part of a corporate group, external to the group; and
 (iii) is not, and has not, been involved in the design, implementation, operation or management of the applicant's proposed accredited services or DI data environment; and
 (c) include:
 (i) details of the flow of personal information into, within and from the applicant's DI data environment;
 (ii) an assessment of the relevant documentation, processes and mechanisms to facilitate the applicant's compliance with the privacy requirements specified in Chapter 3 of the Act and Part 4.3 of Chapter 4 of these rules;
 (iii) an analysis of how the applicant's provision of its proposed accredited services will impact the privacy of individuals and protection of personal information, if the applicant is accredited, including how the applicant will comply with any applicable requirements in Chapter 5 of these rules and the Accreditation Data Standards;
 (iv) an analysis of whether any privacy risks or impacts identified in the privacy impact assessment are necessary or unavoidable;
 (v) any recommendations made by the person who conducted the assessment, including recommendations that the applicant undertake activities to mitigate any identified privacy risks;
 (vi) whether any recommendations of the person who conducted the privacy impact assessment to mitigate any privacy risks or impacts have been accepted and, if not, why actions to address such risks or recommendations are not necessary; and
 (vii) details of consultation with relevant stakeholders.
 (3) The applicant must respond in writing to the findings of the privacy impact assessment.
 (4) The applicant's response to the privacy impact assessment must be signed by the applicant's