Privacy Act 1988 (Australia) AUPRV-3: APP 6-9 Use/Disclosure, Direct Marketing, Cross-Border, Government Identifiers
Per APPs 6-9: use + disclosure + marketing + cross-border + government identifiers. Requirements include (a) implement APP 6 - Use or Disclosure of Personal Information only for primary purpose collected unless data subject would reasonably expect or has consented + (b) implement APP 7 - Direct Marketing only where conditions met + opt-out mechanism + (c) implement APP 8 - Cross-Border Disclosure of Personal Information including reasonable steps that recipient does not breach APPs + (d) implement APP 9 - Adoption, Use, or Disclosure of Government Related Identifiers prohibited except in limited circumstances + (e) maintain records of use + disclosure + cross-border flows + (f) implement contractual + technical safeguards.
What else in your programme already covers this
This control maps to 41 controls across 37 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.