Australian Privacy Principles (APPs)
Part 4 - Integrity of Personal Information

Australian Privacy Principles (APPs) APP-11: APP 11 - Security of personal information

Take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure, and destroy or de-identify it when no longer needed.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 63 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Australia My Health Records Act 2012 · 6 controls

  • MYHR-ENF-1 Mandatory data breach notification
  • MYHR-GOV-5 Retention, destruction and correction obligations of the System Operator
  • MYHR-SEC-1 Written security and access policy
  • MYHR-SEC-2 Access controls and user account management
  • MYHR-SEC-3 Audit logging and access monitoring
  • MYHR-SEC-5 Security risk assessment

APEC Cross-Border Privacy Rules (CBPR) System · 5 controls

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 4 controls

  • ANSSI-HYG-09 Assign the Correct Rights on Sensitive Resources
  • ANSSI-HYG-18 Encrypt Sensitive Data Transmitted Over the Internet
  • ANSSI-HYG-31 Encrypt Sensitive Data, in Particular on Equipment That May Be Lost
  • ANSSI-HYG-37 Define and Apply a Backup Policy for Critical Components

APPI · 4 controls

C5 (Germany) · 4 controls

  • C5-CRY-03 Encryption of sensitive data for storage
  • C5-IDM-09 Authentication mechanisms
  • C5-PI-03 Secure deletion of data
  • C5-PS-01 Physical Security and Environmental Control Requirements

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 4 controls

FedRAMP High · 4 controls

  • AC-3 Access Enforcement
  • MP-6 Media Sanitization
  • SC-28 Protection of Information at Rest
  • SC-8 Transmission Confidentiality and Integrity

FedRAMP Moderate · 4 controls

  • AC-3 Access Enforcement
  • MP-6 Media Sanitization
  • SC-28 Protection of Information at Rest
  • SC-8 Transmission Confidentiality and Integrity

GDPR · 4 controls

HIPAA Security Rule · 4 controls

ISO 27701:2019 · 4 controls

  • 5.2.4 Information security management system
  • 7.4.5 PII de-identification and deletion at the end of processing
  • 7.4.7 Retention
  • 7.4.8 Disposal

CCPA/CPRA · 3 controls

  • §1798.100 General Duties of Businesses that Collect Personal Information
  • §1798.105 Right to Delete Personal Information
  • §1798.150 Private Right of Action for Data Breaches

NIST SP 800-66 Rev 2 · 3 controls

ACT Workplace Privacy Act 2011 · 2 controls

  • 44(1) s 44(1) Reasonable steps to protect surveillance records
  • 44(2) s 44(2) Destroy or permanently de-identify surveillance records no longer needed

Australian Energy Sector Cyber Security Framework (AESCSF) · 2 controls

  • AESCSF-APM-1 Australian privacy management
  • AESCSF-APM-2 Privacy breach management

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-PS-12 Privacy Safeguard 12 - Security of CDR data and destruction or de-identification of redundant CDR data

Australia NDIS Practice Standards and Quality Indicators · 1 control

  • core-12.4 Information management: secure handling through to retention and destruction

Australia NHMRC National Statement on Ethical Conduct in Human Research · 1 control

Competition and Consumer (Consumer Data Right) Rules 2020 · 1 control

  • AUCDR-OB-5 Deletion or de-identification of redundant data

NSW Workplace Surveillance Act 2005 · 1 control

  • s36 s 36 Secure storage of covert surveillance records

Queensland Residential Tenancies and Rooming Accommodation Act 2008 · 1 control

  • s457E s 457E Store securely, restrict access and destroy applicant and tenant information on time

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Part 4 - Integrity of Personal Information

You are reading one control. How much of Australian Privacy Principles (APPs) have you already done?

Australian Privacy Principles (APPs) APP-11 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Australian Privacy Principles (APPs) your existing evidence covers. Hold GDPR and 11 of 13 Australian Privacy Principles (APPs) controls already carry evidence.

If you hold GDPR84.6% covered · 2 gapsIf you hold ISO 27701:201976.9% covered · 3 gapsIf you hold APEC Cross-Border Privacy Rules (CBPR) System69.2% covered · 4 gapsIf you hold CCPA/CPRA69.2% covered · 4 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the GDPR pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 63 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Australian Privacy Principles (APPs) controls