131Compliance assessments

131 Compliance assessments

(1) The Digital ID Regulator may, by written notice, require an entity to undergo an assessment (a compliance assessment): (a) for the purposes of determining whether the entity has complied, is complying or is able to comply with this Act; or (b) if the Digital ID Regulator is satisfied that any of the following has occurred, or is suspected to have occurred, in relation to an accredited entity: (i) a cyber security incident; (ii) a digital ID fraud incident; (iii) a serious or repeated breach of the Accreditation Rules; (iv) an incident that is having, or may have, a material impact on the operation of the entity’s information technology systems through which it provides its accredited services; (v) an incident that is having, or may have, a material impact on the operation of the Australian Government Digital ID System; (vi) a change to the entity’s operating environment that is having, or may have, a material impact on the entity’s risk profile; or (c) in circumstances specified in the Digital ID Rules.

Note: For variation and revocation of a notice given under this subsection, see subsection 33(3) of the Acts Interpretation Act 1901.

(2) The notice must specify: (a) the period within which the compliance assessment is to be undertaken; and (b) whether the compliance assessment must be undertaken: (i) by or on behalf of the Digital ID Regulator; or (ii) by an independent assessor arranged by the entity. (3) The entity must comply with the notice within the period specified in the notice.

Note 1: If an entity has applied for approval to participate in the Australian Government Digital ID System and is given a notice under subsection (1), the Digital ID Regulator is not required to make a decision on the application until the assessment is conducted (see subsection 143(4)).

Note 2: For accredited entities and entities that hold an approval to participate in the Australian Government Digital ID System, a failure to comply with a notice given under subsection (1) may lead to compliance action such as suspension and revocation of approvals and accreditation.

(4) The Digital ID Rules may make provision for and in relation to compliance assessments. (5) Without limiting subsection (4), the Digital ID Rules may make provision for or in relation to the following: (a) processes to be followed during a compliance assessment or after a compliance assessment has been conducted; (b) information that must be provided to or by an entity during a compliance assessment or after a compliance assessment has been conducted; (c) requirements in relation to reports to be provided in relation to a compliance assessment; (d) actions the Digital ID Regulator may require the entity subject to a compliance assessment to take during the compliance assessment or after the assessment has been conducted. (6) This section does not limit the Accreditation Rules that may be made for the purposes of section 28.