Document ID: chunk:federal_register_of_legislation:C2025C00160:section:26:p1
Version: federal_register_of_legislation:C2025C00160
Segment Type: section
Provision Reference: s 26 (pt 1/2)
Character Range: 56762–59539

26  Revocation of accreditation

Digital ID Regulator must revoke accreditation if Minister gives a direction to do so
 (1) The Digital ID Regulator must, in writing, revoke the accreditation of an accredited entity if the Minister gives a direction under subsection 27(1) to do so.

Revocation on Digital ID Regulator's own initiative
 (2) The Digital ID Regulator may, in writing, revoke an entity's accreditation if:
 (a) the Digital ID Regulator reasonably believes that the accredited entity has contravened or is contravening this Act; or
 (b) the Digital ID Regulator reasonably believes that:
 (i) there has been a cyber security incident involving the entity; and
 (ii) the cyber security incident is serious; or
 (c) if the entity is a body corporate—the entity becomes a Chapter 5 body corporate (within the meaning of the Corporations Act 2001); or
 (d) the Digital ID Regulator is satisfied that it is not appropriate for the entity to be an accredited entity; or
 (e) circumstances specified in the Accreditation Rules apply in relation to the entity.
Note: The Digital ID Regulator may impose conditions on an entity's accreditation before revoking it (see paragraph 17(4)(g)) and can give directions to give effect to a decision to revoke an entity's accreditation (see paragraph 127(1)(b)).
 (3) In determining whether the Digital ID Regulator is satisfied of the matter in paragraph (2)(d), regard may be had to whether the entity is a fit and proper person.
Note: In having regard to whether an entity is a fit and proper person, the Digital ID Regulator must have regard to any matters specified in the Digital ID Rules and may have regard to any other matters considered relevant (see section 12).
 (4) Subsection (3) does not limit paragraph (2)(d).

Revocation on application
 (5) The Digital ID Regulator must, on application by an entity, revoke the entity's accreditation.
Note: See Part 5 of Chapter 9 for matters relating to applications.

Date of effect
 (6) The revocation takes effect on the day determined by the Digital ID Regulator.

Approval must also be revoked
 (7) If:
 (a) an entity's accreditation is revoked under subsection (1), (2) or (5); and
 (b) the entity holds an approval to participate in the Australian Government Digital ID System;
the Digital ID Regulator must at the same time revoke the entity's approval to participate as an accredited entity.

Show cause notice must generally be given before decision to revoke
 (8) Before revoking the accreditation of an entity under subsection (2), the Digital ID Regulator must give a written notice (a show cause notice) to the entity.
 (9) The show cause notice must:
 (a) state the grounds on which the Digital ID Regulator proposes to revoke the entity's accreditation; and
 (b)