{"type":"doc","content":[{"type":"section","attrs":{"id":"navPoint_29"},"content":[{"type":"heading","attrs":{"id":"v0-p-1390","level":5},"content":[{"type":"text","text":"12F","marks":[{"type":"bold"}]},{"type":"text","text":"  ","marks":[{"type":"bold"}]},{"type":"text","text":"Meaning of ","marks":[{"type":"bold"}]},{"type":"text","text":"critical","marks":[{"type":"bold"},{"type":"italic"}]},{"type":"text","text":" ","marks":[{"type":"bold"}]},{"type":"text","text":"data storage or processing asset","marks":[{"type":"bold"},{"type":"italic"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(1)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1391"},"content":[{"type":"text","text":"An asset is a "},{"type":"text","text":"critical data storage or processing asset","marks":[{"type":"bold"},{"type":"italic"}]},{"type":"text","text":" if:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1392"},"content":[{"type":"text","text":"it is owned or operated by an entity that is a data storage or processing provider; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1393"},"content":[{"type":"text","text":"it is used wholly or primarily to provide a data storage or processing service that relates to business critical data and that is provided by the entity to an end"},{"type":"text","text":"‑"},{"type":"text","text":"user that is:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1394"},"content":[{"type":"text","text":"the Commonwealth; or"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1395"},"content":[{"type":"text","text":"a body corporate established by a law of the Commonwealth; or"}]}]},{"type":"legalListItem","attrs":{"marker":"(iii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1396"},"content":[{"type":"text","text":"a State; or"}]}]},{"type":"legalListItem","attrs":{"marker":"(iv)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1397"},"content":[{"type":"text","text":"a body corporate established by a law of a State; or"}]}]},{"type":"legalListItem","attrs":{"marker":"(v)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1398"},"content":[{"type":"text","text":"a Territory; or"}]}]},{"type":"legalListItem","attrs":{"marker":"(vi)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1399"},"content":[{"type":"text","text":"a body corporate established by a law of a Territory; and"}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(c)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1400"},"content":[{"type":"text","text":"the entity knows that the asset is used as described in paragraph"},{"type":"text","text":" "},{"type":"text","text":"(b); and"}]}]},{"type":"legalListItem","attrs":{"marker":"(d)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1401"},"content":[{"type":"text","text":"the asset is not a critical infrastructure asset that is covered by a paragraph"},{"type":"text","text":" "},{"type":"text","text":"of subsection"},{"type":"text","text":" "},{"type":"text","text":"9(1) (other than paragraph"},{"type":"text","text":" "},{"type":"text","text":"9(1)(d))."}]}]}]},{"type":"paragraph","attrs":{"id":"v0-p-1402"},"content":[{"type":"text","text":"Note 1:"},{"type":"text","text":" "},{"type":"text","text":"The rules may prescribe that a specified critical data storage or processing asset is not a critical infrastructure asset (see section"},{"type":"text","text":" "},{"type":"text","text":"9)."}]},{"type":"paragraph","attrs":{"id":"v0-p-1403"},"content":[{"type":"text","text":"Note 2:"},{"type":"text","text":" "},{"type":"text","text":"A critical data storage or processing asset that is owned or operated by a carrier may also be a critical telecommunications asset."}]}]},{"type":"legalListItem","attrs":{"marker":"(2)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1404"},"content":[{"type":"text","text":"An asset is a "},{"type":"text","text":"critical data storage or processing asset","marks":[{"type":"bold"},{"type":"italic"}]},{"type":"text","text":" if:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1405"},"content":[{"type":"text","text":"it is owned or operated by an entity that is a data storage or processing provider; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1406"},"content":[{"type":"text","text":"it is used wholly or primarily to provide a data storage or processing service that:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1407"},"content":[{"type":"text","text":"is provided by the entity to an end"},{"type":"text","text":"‑"},{"type":"text","text":"user that is the responsible entity for a critical infrastructure asset; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1408"},"content":[{"type":"text","text":"relates to business critical data; and"}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(c)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1409"},"content":[{"type":"text","text":"the entity knows that the asset is used as described in paragraph"},{"type":"text","text":" "},{"type":"text","text":"(b); and"}]}]},{"type":"legalListItem","attrs":{"marker":"(d)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1410"},"content":[{"type":"text","text":"the asset is not a critical infrastructure asset that is covered by a paragraph"},{"type":"text","text":" "},{"type":"text","text":"of subsection"},{"type":"text","text":" "},{"type":"text","text":"9(1) (other than paragraph"},{"type":"text","text":" "},{"type":"text","text":"9(1)(d))."}]}]}]},{"type":"paragraph","attrs":{"id":"v0-p-1411"},"content":[{"type":"text","text":"Note 1:"},{"type":"text","text":" "},{"type":"text","text":"The rules may prescribe that a specified critical data storage or processing asset is not a critical infrastructure asset (see section"},{"type":"text","text":" "},{"type":"text","text":"9)."}]},{"type":"paragraph","attrs":{"id":"v0-p-1412"},"content":[{"type":"text","text":"Note 2:"},{"type":"text","text":" "},{"type":"text","text":"A critical data storage or processing asset that is owned or operated by a carrier may also be a critical telecommunications asset."}]}]},{"type":"legalListItem","attrs":{"marker":"(3)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1413"},"content":[{"type":"text","text":"If:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1414"},"content":[{"type":"text","text":"an entity (the "},{"type":"text","text":"first entity","marks":[{"type":"bold"},{"type":"italic"}]},{"type":"text","text":") is the responsible entity for a critical infrastructure asset; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1415"},"content":[{"type":"text","text":"the first entity becomes aware that a data storage or processing service:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1416"},"content":[{"type":"text","text":"is provided by another entity on a commercial basis to the first entity; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1417"},"content":[{"type":"text","text":"relates to business critical data;"}]}]}]}]}]},{"type":"paragraph","attrs":{"id":"v0-p-1418"},"content":[{"type":"text","text":"the first entity must:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(c)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1419"},"content":[{"type":"text","text":"take reasonable steps to inform that other entity that the first entity has become aware that the data storage or processing service:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1420"},"content":[{"type":"text","text":"is provided by the other entity on a commercial basis to the first entity; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1421"},"content":[{"type":"text","text":"relates to business critical data; and"}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(d)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-1422"},"content":[{"type":"text","text":"do so as soon as practicable after becoming so aware."}]}]}]},{"type":"paragraph","attrs":{"id":"v0-p-1423"},"content":[{"type":"text","text":"Civil penalty for contravention of this subsection:"},{"type":"text","text":" "},{"type":"text","text":"50 penalty units."}]}]}]}]}]}