39Notification of eligible data breaches—accredited entities that are APP entities

39 Notification of eligible data breaches—accredited entities that are APP entities

(1) This section applies to an accredited entity if the entity: (a) is an APP entity; and (b) is aware that there are reasonable grounds to believe that there has been an eligible data breach (within the meaning of the Privacy Act 1988) of the entity relating to the entity’s accredited services; and (c) is required under section 26WK of the Privacy Act 1988 to give the Information Commissioner a statement that complies with subsection 26WK(3) of that Act. (2) The entity must also give a copy of the statement to the Digital ID Regulator at the same time as the statement is given to the Information Commissioner.