28Accreditation Rules

28 Accreditation Rules

(1) The Accreditation Rules must provide for and in relation to matters concerning the accreditation of entities. (2) Without limiting subsection (1), the Accreditation Rules may deal with the following matters: (a) requirements that entities must meet in order to become and remain an accredited entity, including requirements relating to the following: (i) privacy; (ii) security; (iii) fraud control; (iv) incident management and reporting; (v) disaster recovery; (vi) user experience and inclusion; (b) without limiting paragraph (a), requirements relating to the conduct of, and reporting on, privacy impact assessments, fraud assessments and security assessments; (c) technical, data or design standards relating to the provision of accredited services of accredited entities; (d) without limiting paragraph (c), standards relating to the testing of the information technology systems of entities; (e) the conduct of periodic reviews of an entity’s compliance with specified requirements of the Accreditation Rules, including the timing of such reviews, who is to conduct such reviews and the provision of reports about such reviews to the Digital ID Regulator; (f) the obligations of accredited entities in relation to monitoring their compliance with this Act; (g) requirements relating to the collection, holding, use and disclosure of personal information of individuals; (h) matters relating to representatives or nominees of individuals in relation to the creation, maintenance or deactivation of digital IDs of individuals; (i) requirements or restrictions relating to the generation of digital IDs for children.

Note: In relation to subparagraph (2)(a)(iv), the Digital ID Rules may also provide for such arrangements in relation to incidents that occur within the Australian Government Digital ID System (see subsection 78(1)).