Skip to content
Legislation
Skip to legislation

Cyber Security Act 2024 · Version 2024-11-29

Division 3—Enforcement

Register source version C2024A00098 · Source observation:

Reading presentation · Verification limits and dated status · No live currency check

Part 2—Security standards for smart devices

Read this container only

Division 3—Enforcement

Read this container only

17 Compliance notice

  • (1) The Secretary may give an entity that must comply with an obligation under section 15 or 16 a compliance notice if the Secretary:
  • (a) is reasonably satisfied that the entity is not complying with the obligation; or
  • (b) is aware of information that suggests that the entity may not be complying with the obligation.
  • (2) The compliance notice must:
  • (a) set out the name of the entity to which the notice is given; and
  • (b) set out brief details of the non‑compliance or possible non‑compliance; and
  • (c) specify action within the entity’s control that the entity must take in order to address the non‑compliance or possible non‑compliance; and
  • (d) specify a reasonable period within which the entity must take the specified action; and
  • (e) if the Secretary considers it appropriate—specify a reasonable period within which the entity must provide the Secretary with evidence that the entity has taken the specified action; and
  • (f) explain what may happen if the entity does not comply with the notice; and
  • (g) explain how the entity may seek review of the decision to issue the notice; and
  • (h) set out any other matters prescribed by the rules.
  • (3) Before giving the notice to the entity, the Secretary must:
  • (a) notify the entity that the Secretary intends to give the notice to the entity; and
  • (b) give the entity a specified period (which must not be shorter than 10 days) to make representations about the giving of the notice.
  • (4) Only one compliance notice may be given to an entity in relation to a particular instance of the entity’s non‑compliance, or possible non‑compliance, with an obligation under section 15 or 16.

18 Stop notice

  • (1) The Secretary may give an entity that must comply with an obligation under section 15 or 16 a stop notice if:
  • (a) the entity has been given a compliance notice under section 17 in relation to the non‑compliance with the obligation; and
  • (b) the Secretary is reasonably satisfied that:
    • (i) the entity has not complied with the compliance notice; or
    • (ii) actions taken by the entity to rectify non‑compliance with the obligation (whether in accordance with the compliance notice or otherwise) are inadequate to rectify the non‑compliance.
  • (2) The stop notice must:
  • (a) set out the name of the entity to which the notice is given; and
  • (b) set out brief details of the non‑compliance; and
  • (c) specify action within the entity’s control that the entity must take, or refrain from taking, in order to address the non‑compliance; and
  • (d) specify a reasonable period within which the entity must take the specified action or refrain from taking the specified action; and
  • (e) if the Secretary considers it appropriate—specify a reasonable period within which the entity must provide the Secretary with evidence that the entity has taken the specified action or refrained from taking the specified action; and
  • (f) explain what may happen if the entity does not comply with the notice; and
  • (g) explain how the entity may seek review of the decision to issue the notice; and
  • (h) set out any other matters prescribed by the rules.
  • (3) Before giving the notice to the entity, the Secretary must:
  • (a) notify the entity that the Secretary intends to give the notice to the entity; and
  • (b) give the entity a specified period (which must not be shorter than 10 days) to make representations about the giving of the notice.
  • (4) Only one stop notice may be given to an entity in relation to a particular instance of the entity’s non‑compliance with an obligation under section 15 or 16.

19 Recall notice

  • (1) The Secretary may give an entity that must comply with an obligation under section 15 or 16 a recall notice if:
  • (a) the entity has been given a stop notice under section 18 in relation to the non‑compliance with the obligation; and
  • (b) the Secretary is reasonably satisfied that:
    • (i) the entity has not complied with the stop notice; or
    • (ii) actions taken by the entity to rectify the non‑compliance with the obligation (whether in accordance with the compliance notice or otherwise) are inadequate to rectify the non‑compliance.
  • (2) The recall notice must:
  • (a) set out the name of the entity to which the notice is given; and
  • (b) set out brief details of the non‑compliance; and
  • (c) specify action that the entity must take to do any or all of the following:
    • (i) ensure, to the extent within the entity’s control, the product is not acquired in Australia;
    • (ii) ensure, to the extent within the entity’s control, that the product is not supplied to suppliers for supply in Australia;
    • (iii) arrange for the return, within a specified reasonable period, of the product to the entity, or if the entity is not the manufacturer of the product, the manufacturer of the product; and
  • (d) specify a reasonable period within which the entity must take the specified action; and
  • (e) if the Secretary considers it appropriate—specify a reasonable period within which the entity must provide the Secretary with evidence that the entity has taken the specified action; and
  • (f) explain what may happen if the entity does not comply with the notice; and
  • (g) explain how the entity may seek review of the decision to issue the notice; and
  • (h) set out any other matters prescribed by the rules.
  • (3) Before giving the notice to the entity, the Secretary must:
  • (a) notify the entity that the Secretary intends to give the notice to the entity; and
  • (b) give the entity a specified period (which must not be shorter than 10 days) to make representations about the giving of the notice.
  • (4) Only one recall notice may be given to an entity in relation to a particular instance of the entity’s non‑compliance with an obligation under section 15 or 16.

20 Public notification of failure to comply with recall notice

If an entity fails to comply with a recall notice, the Minister may publish the following information on the Department’s website, or in any other way the Minister considers appropriate:

  • (a) the identity of the entity;
  • (b) details of the product;
  • (c) details of the non‑compliance;
  • (d) risks posed by the product relating to the non‑compliance;
  • (e) any other matters prescribed by the rules.