APPI APPI-A28: Provision to Third Parties in Foreign Countries

What else in your programme already covers this

This control maps to 28 controls across 15 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

GDPR · 4 controls

GDPR-Art.44 General principle for transfers
GDPR-Art.45 Transfers on the basis of an adequacy decision
GDPR-Art.46 Transfers subject to appropriate safeguards
GDPR-Art.49 Derogations for specific situations

APEC Cross-Border Privacy Rules (CBPR) System · 3 controls

CBPR-08 Accountability
CBPR-PR-47 Processor agreement content
CBPR-PR-49 Spot checking and monitoring of processors

ISO 27701:2019 · 3 controls

7.5.1 Identify basis for PII transfer between jurisdictions
7.5.2 Countries and international organizations to which PII can be transferred
7.5.3 Records of transfer of PII

Australian Privacy Principles (APPs) · 2 controls

APP-5 APP 5 - Notification of the collection of personal information
APP-8 APP 8 - Cross-border disclosure of personal information

C5 (Germany) · 2 controls

C5-PSS-12 Locations of Data Processing and Storage
C5-SSO-04 Monitoring of compliance with requirements

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-DSP-10 Sensitive Data Transfer
CCM-DSP-19 Data Location

ISO 27001:2022 · 2 controls

5.14 Information transfer
5.31 Legal, statutory, regulatory and contractual requirements

NIST SP 800-161 Rev 1 · 2 controls

161R1-CA-7 Continuous Monitoring
161R1-SR-6 Supplier Assessments and Reviews

NIST SP 800-53 Rev 5 · 2 controls

NIST800-AC-21 AC-21 Information Sharing
NIST800-PT-4 PT-4 Consent

Australia My Health Records Act 2012 · 1 control

MYHR-CUD-4 Records not held or taken outside Australia

FedRAMP High · 1 control

SA-9(5) External System Services | Processing, Storage, and Service Location (SA-9(5))

FedRAMP Moderate · 1 control

SA-9(5) External System Services | Processing, Storage, and Service Location (SA-9(5))

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

SOC 2 · 1 control

SOC2-P6.1 P6.1 Disclosure to third parties with consent

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of APPI have you already done?

APPI APPI-A28 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of APPI your existing evidence covers. Hold APEC Cross-Border Privacy Rules (CBPR) System and 16 of 30 APPI controls already carry evidence.

If you hold APEC Cross-Border Privacy Rules (CBPR) System53.3% covered · 14 gaps If you hold ISO 27701:201953.3% covered · 14 gaps If you hold NIST SP 800-53 Rev 553.3% covered · 14 gaps If you hold SOC 253.3% covered · 14 gaps If you hold GDPR50% covered · 15 gaps If you hold CCPA/CPRA46.7% covered · 16 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the APEC Cross-Border Privacy Rules (CBPR) System pair alone.

See the released pairs, $299 each Browse the graph free