APPI APPI-A29: Records When Providing Personal Data to a Third Party

What else in your programme already covers this

This control maps to 22 controls across 15 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27701:2019 · 3 controls

7.2.8 Records related to processing PII
7.5.3 Records of transfer of PII
7.5.4 Records of PII disclosure to third parties

Australia My Health Records Act 2012 · 2 controls

MYHR-SBD-3 Record keeping for sharing with the My Health Record system
MYHR-SEC-3 Audit logging and access monitoring

CCPA/CPRA · 2 controls

CCR §7100-7102 Recordkeeping Requirements
§1798.115 Right to Know Personal Information Sold or Shared and Recipients

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-DSP-05 Data Flow Documentation
CCM-DSP-14 Disclosure of Data Sub-processors

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-ID.AM-07 Inventories of data and corresponding metadata for designated data types are maintained
NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring

SOC 2 · 2 controls

SOC2-P6.2 P6.2 Record of authorised disclosures
SOC2-P6.7 P6.7 Accounting of personal information held and disclosed

APEC Cross-Border Privacy Rules (CBPR) System · 1 control

CBPR-PR-10 Disclosure to other controllers identified

Australian Privacy Principles (APPs) · 1 control

APP-1 APP 1 - Open and transparent management of personal information

FedRAMP High · 1 control

CA-3 Information Exchange

GDPR · 1 control

GDPR-Art.30 Records of processing activities

NIST SP 800-161 Rev 1 · 1 control

161R1-PM-21 Accounting of Disclosures

NIST SP 800-53 Rev 5 · 1 control

NIST800-PM-21 PM-21 Accounting of Disclosures

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of APPI have you already done?

APPI APPI-A29 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of APPI your existing evidence covers. Hold APEC Cross-Border Privacy Rules (CBPR) System and 16 of 30 APPI controls already carry evidence.

If you hold APEC Cross-Border Privacy Rules (CBPR) System53.3% covered · 14 gaps If you hold ISO 27701:201953.3% covered · 14 gaps If you hold NIST SP 800-53 Rev 553.3% covered · 14 gaps If you hold SOC 253.3% covered · 14 gaps If you hold GDPR50% covered · 15 gaps If you hold CCPA/CPRA46.7% covered · 16 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the APEC Cross-Border Privacy Rules (CBPR) System pair alone.

See the released pairs, $299 each Browse the graph free