Cyber Security Act 2024
19Recall notice
Start here
Get a plain-English read of 19
Turn the raw legal text into a practical explanation grounded in Cyber Security Act 2024.
19 Recall notice
(1) The Secretary may give an entity that must comply with an obligation under section 15 or 16 a recall notice if:
(a) the entity has been given a stop notice under section 18 in relation to the non‑compliance with the obligation; and
(b) the Secretary is reasonably satisfied that:
(i) the entity has not complied with the stop notice; or
(ii) actions taken by the entity to rectify the non‑compliance with the obligation (whether in accordance with the compliance notice or otherwise) are inadequate to rectify the non‑compliance.
(2) The recall notice must:
(b) set out brief details of the non‑compliance; and
(c) specify action that the entity must take to do any or all of the following:
(i) ensure, to the extent within the entity’s control, the product is not acquired in Australia;
(ii) ensure, to the extent within the entity’s control, that the product is not supplied to suppliers for supply in Australia;
(iii) arrange for the return, within a specified reasonable period, of the product to the entity, or if the entity is not the manufacturer of the product, the manufacturer of the product; and
(d) specify a reasonable period within which the entity must take the specified action; and
(e) if the Secretary considers it appropriate—specify a reasonable period within which the entity must provide the Secretary with evidence that the entity has taken the specified action; and
(b) give the entity a specified period (which must not be shorter than 10 days) to make representations about the giving of the notice.
(4) Only one recall notice may be given to an entity in relation to a particular instance of the entity’s non‑compliance with an obligation under section 15 or 16.