38—Duty to notify of notifiable incidents
(1) A person who
conducts a business or undertaking must ensure that the regulator is notified
immediately after becoming aware that a notifiable incident arising out of the
conduct of the business or undertaking has occurred.
Maximum penalty:
(a) in
the case of an individual—$10 000;
(b) in
the case of a body corporate—$50 000.
(2) The notice must be
given in accordance with this section and by the fastest possible means.
(3) The notice must be
given—
(a) by
telephone; or
(b) in
writing.
Example—
The written notice can be given by fax, email or other electronic means.
(4) A person giving
notice by telephone must—
(a) give
the details of the incident requested by the regulator; and
(b) if
required by the regulator, give a written notice of the incident within
48 hours of that requirement being made.
(5) A written notice
must be in a form, or contain the details, approved by the regulator.
(6) If the regulator
receives a notice by telephone and a written notice is not required, the
regulator must give the person conducting the business or undertaking—
(a)
details of the information received; or
(b) an
acknowledgement of receiving the notice.
(7) A
person conducting a business or undertaking must keep a record of each
notifiable incident for at least 5 years from the day that notice of the
incident is given to the regulator under this section.
Maximum penalty:
(a) in
the case of an individual—$5 000;
(b) in
the case of a body corporate—$25 000.