(1) A data custodian must, within the period applicable under subsection (4) after the end of a financial year, notify the Commissioner, in the approved form (if any), of the following in relation to the financial year:
(a) whether it received requests from accredited users to share data under this Act;
(b) if it received any such requests--the number of requests and the reasons it agreed to or refused them;
(c) if it refused any such requests--the number of requests that were refused where reasons for the refusal were not given within the time required by subsection 25(3);
(d) whether it received complaints relating to the data sharing scheme or its conduct in relation to it, and if it did, the number of complaints and information about the subject matter of the complaints;
(e) whether it entered into any data sharing agreements and if it did, the number entered into.
(2) A data custodian must give the Commissioner any other information and assistance the Commissioner reasonably requires in relation to the preparation of the annual report mentioned in section 138.
(3) An entity that was an accredited entity at any time during a financial year must give the Commissioner any information and assistance the Commissioner reasonably requires in relation to the preparation of the annual report for the financial year mentioned in section 138.
(4) The period for notifying the Commissioner is:
(a) the period applicable under a data code; or
(b) if there is no period applicable under a data code--as soon as practicable.