Document ID: chunk:federal_register_of_legislation:F2024L01430:reg:3:p3
Version: federal_register_of_legislation:F2024L01430
Segment Type: reg
Provision Reference: reg 3 (pt 3/8)
Character Range: 20318–23151

as soon as reasonably practicable, and in any event within 48 hours of the outstanding information becoming available to the entity.

4.3  Other incidents
 (1) This rule applies to:
 (a) a participating entity; and
 (b) an entity whose approval to participate is suspended;
in respect of incidents that have occurred, or are reasonably suspected of having occurred, while the entity was participating in the Australian Government Digital ID System.
 (2) The entity must notify the Digital ID Regulator, in accordance with this rule, of the following incidents:
 (a) any material change in the entity's circumstances that might affect its ability to comply with its obligations under the Act, these rules, the Accreditation Rules, the Accreditation Data Standards and the AGDIS Data Standards;
 (b) any matter that could reasonably be considered relevant to whether the entity is a fit and proper person for the purposes of the Act, these rules, the Accreditation Rules, the Accreditation Data Standards and the AGDIS Data Standards, including matters involving an associated person of the entity; and
 (c) any material change to, or error in, any of the information provided to the Digital ID Regulator.
 (3) If the entity is an accredited entity—the entity must notify the System Administrator, in accordance with this rule, of the following incidents:
 (a) any proposed change to the entity's information technology system that interacts with the Australian Government Digital ID System, where the change will, or could reasonably be expected to, have a material effect on the operation of the Australian Government Digital ID System; and
 (b) any planned or unplanned outage or downtime affecting the entity's information technology system, where the outage or downtime will, or could reasonably be expected to, have a material effect on the operation of the Australian Government Digital ID System.
 (4) The notification must include the following information:
 (a) the entity's name;
 (b) the contact details for the entity;
 (c) if the incident relates to an associated person of the entity—the name and contact details of the associated person;
 (d) a description of the incident; and
 (e) the following details of the incident:
 (i) the date and time of the incident; and
 (ii) the date on which the entity became aware of the incident.
 (5) The notification must be made no later than 5 business days after the earliest of the following:
 (a) the entity becomes aware that the incident has occurred; or
 (b) the entity reasonably suspects that the incident has occurred.

4.4  Other digital ID systems
 (1) This rule applies to:
 (a) an accredited entity that holds an approval to participate; and
 (b) an accredited entity whose approval to participate is suspended.
 (2) The entity must notify the Digital ID Regulator, in