38—Duty to notify of notifiable incidents
(1) A person who conducts a business or undertaking must ensure that the regulator is notified immediately after becoming aware that a notifiable incident arising out of the conduct of the business or undertaking has occurred.
Maximum penalty:
(a) in the case of an individual—$10 000;
(b) in the case of a body corporate—$50 000.
(2) The notice must be given in accordance with this section and by the fastest possible means.
(3) The notice must be given—
(a) by telephone; or
(b) in writing.
Example—
The written notice can be given by fax, email or other electronic means.
(4) A person giving notice by telephone must—
(a) give the details of the incident requested by the regulator; and
(b) if required by the regulator, give a written notice of the incident within 48 hours of that requirement being made.
(5) A written notice must be in a form, or contain the details, approved by the regulator.
(6) If the regulator receives a notice by telephone and a written notice is not required, the regulator must give the person conducting the business or undertaking—
(a) details of the information received; or
(b) an acknowledgement of receiving the notice.
(7) A person conducting a business or undertaking must keep a record of each notifiable incident for at least 5 years from the day that notice of the incident is given to the regulator under this section.
Maximum penalty:
(a) in the case of an individual—$5 000;
(b) in the case of a body corporate—$25 000.