APPI APPI-A18: Restriction on Handling Beyond the Purpose of Use

What else in your programme already covers this

This control maps to 30 controls across 12 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

APEC Cross-Border Privacy Rules (CBPR) System · 5 controls

CBPR-03 Uses of Personal Information
CBPR-PR-06 Collection limited to relevant information
CBPR-PR-08 Use limited to stated purposes
CBPR-PR-09 Grounds for unrelated use
CBPR-PR-13 Grounds for other disclosure

ISO 27701:2019 · 4 controls

7.2.1 Identify and document purpose
7.2.2 Identify lawful basis
7.2.4 Obtain and record consent
7.4.2 Limit processing

Australia My Health Records Act 2012 · 3 controls

MYHR-CUD-2 Prohibition on unauthorised collection, use and disclosure
MYHR-CUD-3 Use limited to My Health Record purposes
MYHR-SEC-7 Consumer access controls and consent

Australian Privacy Principles (APPs) · 3 controls

APP-3 APP 3 - Collection of solicited personal information
APP-6 APP 6 - Use or disclosure of personal information
APP-7 APP 7 - Direct marketing

GDPR · 3 controls

GDPR-Art.5 Principles relating to processing of personal data
GDPR-Art.6 Lawfulness of processing
GDPR-Art.7 Conditions for consent

NIST SP 800-53 Rev 5 · 3 controls

NIST800-PT-2 PT-2 Authority to Process Personally Identifiable Information
NIST800-PT-3 PT-3 Personally Identifiable Information Processing Purposes
NIST800-PT-4 PT-4 Consent

CCPA/CPRA · 2 controls

§1798.100 General Duties of Businesses that Collect Personal Information
§1798.121 Right to Limit Use and Disclosure of Sensitive Personal Information

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-DSP-12 Limitation of Purpose in Personal Data Processing
CCM-DSP-15 Limitation of Production Data Use

SOC 2 · 2 controls

SOC2-P2.1 P2.1 Choice and consent
SOC2-P4.1 P4.1 Limiting use to identified purposes

ISO 27001:2022 · 1 control

5.34 Privacy and protection of personal identifiable information (PII)

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of APPI have you already done?

APPI APPI-A18 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of APPI your existing evidence covers. Hold APEC Cross-Border Privacy Rules (CBPR) System and 16 of 30 APPI controls already carry evidence.

If you hold APEC Cross-Border Privacy Rules (CBPR) System53.3% covered · 14 gaps If you hold ISO 27701:201953.3% covered · 14 gaps If you hold NIST SP 800-53 Rev 553.3% covered · 14 gaps If you hold SOC 253.3% covered · 14 gaps If you hold GDPR50% covered · 15 gaps If you hold CCPA/CPRA46.7% covered · 16 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the APEC Cross-Border Privacy Rules (CBPR) System pair alone.

See the released pairs, $299 each Browse the graph free