APPI APPI-A32: Matters Concerning Retained Personal Data to Be Made Accessible

What else in your programme already covers this

This control maps to 28 controls across 12 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

APEC Cross-Border Privacy Rules (CBPR) System · 5 controls

CBPR-01 Notice
CBPR-08 Accountability
CBPR-PR-01 Privacy statement published
CBPR-PR-40 Responsible individual appointed
CBPR-PR-41 Complaint handling procedures

ISO 27701:2019 · 5 controls

6.3.1 Internal organization
7.3.1 Determining and fulfilling obligations to PII principals
7.3.2 Determining information for PII principals
7.3.3 Providing information to PII principals
7.3.9 Handling requests

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

CCM-DSP-01 Security and Privacy Policy and Procedures
CCM-DSP-06 Data Ownership and Stewardship
CCM-DSP-14 Disclosure of Data Sub-processors

GDPR · 3 controls

GDPR-Art.12 Transparent information, communication and modalities for rights
GDPR-Art.13 Information to be provided where personal data are collected
GDPR-Art.15 Right of access by the data subject

NIST SP 800-53 Rev 5 · 3 controls

NIST800-PM-20 PM-20 Dissemination of Privacy Program Information
NIST800-PT-1 PT-1 Policy and Procedures
NIST800-PT-5 PT-5 Privacy Notice

Australian Privacy Principles (APPs) · 2 controls

APP-1 APP 1 - Open and transparent management of personal information
APP-5 APP 5 - Notification of the collection of personal information

CCPA/CPRA · 2 controls

§1798.130(a)(1) Designated Methods for Submitting Consumer Requests
§1798.130(a)(3) Privacy Policy Content Requirements

ISO 27001:2022 · 1 control

5.34 Privacy and protection of personal identifiable information (PII)

ISO/IEC 42001:2023 · 1 control

A.8.5 Information for interested parties

NIST SP 800-161 Rev 1 · 1 control

161R1-PM-20 Dissemination of Privacy Program Information

SOC 2 · 1 control

SOC2-P1.1 P1.1 Privacy notice to data subjects

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of APPI have you already done?

APPI APPI-A32 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of APPI your existing evidence covers. Hold APEC Cross-Border Privacy Rules (CBPR) System and 16 of 30 APPI controls already carry evidence.

If you hold APEC Cross-Border Privacy Rules (CBPR) System53.3% covered · 14 gaps If you hold ISO 27701:201953.3% covered · 14 gaps If you hold NIST SP 800-53 Rev 553.3% covered · 14 gaps If you hold SOC 253.3% covered · 14 gaps If you hold GDPR50% covered · 15 gaps If you hold CCPA/CPRA46.7% covered · 16 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the APEC Cross-Border Privacy Rules (CBPR) System pair alone.

See the released pairs, $299 each Browse the graph free