Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:9:p5
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 9 (pt 5/13)
Character Range: 113225–116012

Part:
 (a) before starting work on those duties; and
 (b) at least once in every 12-month period thereafter.

4.45  Data breach response plan
 (1) An accredited entity must have, maintain and comply with a data breach response plan that includes a description of the actions to be taken by the entity in the event of a data breach or suspected data breach involving its accredited services or DI data environment.
 (2) The data breach response plan must:
 (a) identify the roles and responsibilities of any personnel involved in managing a data breach;
 (b) include both a communication plan and guidance for personnel as to when and how information related to a data breach is to be:
 (i) escalated within the entity;
 (ii) notified to individuals affected by the data breach;
 (iii) notified to a third party, including any notifications required by law; and
 (c) not be inconsistent with the entity's fraud control plan or system security plan.
 (3) For the avoidance of doubt, if an accredited entity uses an enterprise or organisation level data breach response plan, that plan must comply with this rule.
 (4) An accredited entity must review and, if required, update its data breach response plan at least once in each reporting period.

4.46  Record keeping
 (1) An accredited entity must:
 (a) keep records of its decisions to use civil, administrative or disciplinary procedures, or to take no further action, in response to a data breach; and
 (b) keep records of the entity's investigation of and response to data breaches.
 (2) Subject to rule 7.8, a record required by this rule must:
 (a) be retained for a minimum of 3 years from the day it was generated; and
 (b) not contain biometric information.

Part 4.4—Accredited services must be accessible and inclusive

4.47  Application
  This Part applies for the purposes of subsection 30(1) of the Act.

4.48  Reporting on accessibility
  Once in each reporting period, an accredited entity must prepare a report detailing:
 (a) any reasonable steps taken by the entity during that reporting period to ensure its accredited services are accessible for individuals who experience barriers when creating or using a digital ID; and
 (b) any reasonable steps the entity proposes to take in the next reporting period to improve the accessibility of its services.
Note 1: See subsection 30(1AA) of the Act.
Note 2: The report must be included in the annual report provided to the Digital ID Regulator as part of the entity's annual review–see Chapter 6.

4.49  Accessibility requirements
 (1) An accredited entity must:
 (a) provide individuals with a clear and simple description of the entity's accredited services;
 (b) present public-facing information related to accredited services in a clear and simple manner, using plain