Skip to content
Legislation
Skip to legislation

Cyber Security Act 2024 · Version 2024-11-29

19 Recall notice

Register source version C2024A00098 · Source observation:

Reading presentation · Verification limits and dated status · No live currency check

Part 2—Security standards for smart devices

Read this container only

Division 3—Enforcement

Read this container only

19 Recall notice

  • (1) The Secretary may give an entity that must comply with an obligation under section 15 or 16 a recall notice if:
  • (a) the entity has been given a stop notice under section 18 in relation to the non‑compliance with the obligation; and
  • (b) the Secretary is reasonably satisfied that:
    • (i) the entity has not complied with the stop notice; or
    • (ii) actions taken by the entity to rectify the non‑compliance with the obligation (whether in accordance with the compliance notice or otherwise) are inadequate to rectify the non‑compliance.
  • (2) The recall notice must:
  • (a) set out the name of the entity to which the notice is given; and
  • (b) set out brief details of the non‑compliance; and
  • (c) specify action that the entity must take to do any or all of the following:
    • (i) ensure, to the extent within the entity’s control, the product is not acquired in Australia;
    • (ii) ensure, to the extent within the entity’s control, that the product is not supplied to suppliers for supply in Australia;
    • (iii) arrange for the return, within a specified reasonable period, of the product to the entity, or if the entity is not the manufacturer of the product, the manufacturer of the product; and
  • (d) specify a reasonable period within which the entity must take the specified action; and
  • (e) if the Secretary considers it appropriate—specify a reasonable period within which the entity must provide the Secretary with evidence that the entity has taken the specified action; and
  • (f) explain what may happen if the entity does not comply with the notice; and
  • (g) explain how the entity may seek review of the decision to issue the notice; and
  • (h) set out any other matters prescribed by the rules.
  • (3) Before giving the notice to the entity, the Secretary must:
  • (a) notify the entity that the Secretary intends to give the notice to the entity; and
  • (b) give the entity a specified period (which must not be shorter than 10 days) to make representations about the giving of the notice.
  • (4) Only one recall notice may be given to an entity in relation to a particular instance of the entity’s non‑compliance with an obligation under section 15 or 16.