Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:9:p3
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 9 (pt 3/13)
Character Range: 107905–110802

number of digital IDs affected (if any); and
 (iv) the severity of the incident; and
 (c) a description of the measures taken by the entity in response to the incidents covered by the report.
 (3) Subject to rule 7.8, a record required by this rule must:
 (a) be retained for a minimum of 3 years from the day it was generated; and
 (b) not contain biometric information.

Part 4.3—Privacy

4.36  Privacy governance code
  In this Division:
privacy governance code means the Privacy (Australian Government Agencies — Governance) APP Code 2017.
agency has the same meaning as in the privacy governance code.

4.37  Compliance with privacy governance code
  An accredited entity which is not an agency must comply with the privacy governance code in respect of its accredited services and DI data environment as if the entity were an agency for the purposes of the code.
Note:  The privacy governance code includes requirements that agencies have a privacy officer, privacy champion, privacy management plan, register of privacy impact assessments, privacy education and training. Agencies must also conduct a privacy impact assessment for all high privacy risk projects and regularly review their internal privacy processes.

4.38  Privacy policy
 (1) An accredited entity must have, maintain and comply with a privacy policy covering its accredited services and DI data environment.
 (2) The entity's privacy policy must:
 (a) be written in a clear and simple manner, using plain language that is easy to understand;
 (b) provide sufficient detail about the collection, use and disclosure of personal information related to the entity's accredited services so as to enable an individual to understand how their personal information is collected, used and disclosed; and
 (c) be separate to the privacy policy for its other business and organisational functions.
 (3) An entity which is accredited as more than one kind of accredited entity, must have and maintain either:
 (a) separate privacy policies and privacy management plans for each kind of accredited entity it is accredited as; or
 (b) distinct sections in its privacy policy and privacy management plan for each kind of accredited entity it is accredited as.

4.39  Review
         An accredited entity must review its privacy policy and privacy management plan at least once in each reporting period.

4.40  Providing information about express consent
         An accredited entity that provides public-facing accredited services and is required to obtain the express consent of an individual must ensure that the process for an individual to provide express consent, or to withdraw or vary that consent, is described in clear, simple and accessible terms.

4.41  Duration of express consent
        (1) This rule applies if an individual gives an accredited entity express consent for the future collection, use or disclosure of the