Skip to content
Legislation
Skip to legislation

Cyber Security Act 2024 · Version 2024-11-29

18 Stop notice

Register source version C2024A00098 · Source observation:

Reading presentation · Verification limits and dated status · No live currency check

Part 2—Security standards for smart devices

Read this container only

Division 3—Enforcement

Read this container only

18 Stop notice

  • (1) The Secretary may give an entity that must comply with an obligation under section 15 or 16 a stop notice if:
  • (a) the entity has been given a compliance notice under section 17 in relation to the non‑compliance with the obligation; and
  • (b) the Secretary is reasonably satisfied that:
    • (i) the entity has not complied with the compliance notice; or
    • (ii) actions taken by the entity to rectify non‑compliance with the obligation (whether in accordance with the compliance notice or otherwise) are inadequate to rectify the non‑compliance.
  • (2) The stop notice must:
  • (a) set out the name of the entity to which the notice is given; and
  • (b) set out brief details of the non‑compliance; and
  • (c) specify action within the entity’s control that the entity must take, or refrain from taking, in order to address the non‑compliance; and
  • (d) specify a reasonable period within which the entity must take the specified action or refrain from taking the specified action; and
  • (e) if the Secretary considers it appropriate—specify a reasonable period within which the entity must provide the Secretary with evidence that the entity has taken the specified action or refrained from taking the specified action; and
  • (f) explain what may happen if the entity does not comply with the notice; and
  • (g) explain how the entity may seek review of the decision to issue the notice; and
  • (h) set out any other matters prescribed by the rules.
  • (3) Before giving the notice to the entity, the Secretary must:
  • (a) notify the entity that the Secretary intends to give the notice to the entity; and
  • (b) give the entity a specified period (which must not be shorter than 10 days) to make representations about the giving of the notice.
  • (4) Only one stop notice may be given to an entity in relation to a particular instance of the entity’s non‑compliance with an obligation under section 15 or 16.