Frameworks / Privacy Act 2020 / NZPRV-6 Privacy Act 2020
High-Risk Processing
Privacy Act 2020 NZPRV-6: IPP 13 Unique Identifiers, Privacy Impact Assessment, Privacy by Design Per IPP 13 of Privacy Act 2020 + OPC guidance: unique identifiers + PIA. Requirements include (a) IPP 13 - Unique Identifiers - agency must not assign a unique identifier to an individual unless reasonably necessary + must not require the individual to disclose another agency's unique identifier unless reasonably necessary + (b) conduct Privacy Impact Assessments (PIA) per OPC guidance for processing with significant privacy implications + (c) implement Privacy by Design across systems + processes + procurement + (d) implement Agents and Service Providers controls including contractual safeguards + (e) maintain documented PIAs + safeguards + (f) integrate with broader privacy programme.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 296 controls across 86 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
GDPR-Art.10 Processing of personal data relating to criminal convictions GDPR-Art.11 Processing which does not require identification GDPR-Art.15 Right of access by the data subject GDPR-Art.19 Notification obligation regarding rectification, erasure or restriction GDPR-Art.25 Data protection by design and by default GDPR-Art.35 Data protection impact assessment GDPR-Art.38 Position of the data protection officer GDPR-Art.9 Processing of special categories of personal data AT-DSG-10 Section 29 - Liability and right to compensation / civil jurisdiction AT-DSG-11 Sections 42-45 - Data subject rights (law enforcement) AT-DSG-12 Section 62 - Administrative penalties AT-DSG-13 Section 36 - Scope of law enforcement processing AT-DSG-14 Section 38 - Lawfulness of law enforcement processing AT-DSG-7 Section 18 - Establishment of the Data Protection Authority BB-DPA-1 Section 1 - Short Title BB-DPA-14 Section 15 - Right to Data Portability BB-DPA-16 Section 22 - General Principle for Transfers BB-DPA-20 Sections 50-60 - Registration and Responsibilities BB-DPA-21 Sections 61-69 - Data Privacy Officer BB-DPA-4 Section 4 - Principles Relating to Processing ISO23894-6.3 AI Risk Assessment ISO23894-6.3.1 AI Risk Identification ISO23894-6.3.3 AI Risk Evaluation ISO23894-A.1 Data Quality and Representativeness ISO23894-A.5 Privacy and Data Protection in AI PDPASG-1 Accountability, Records, DPO Appointment, and Training PDPASG-2 Notification, Consent, Purpose Limitation, and Lawful Basis PDPASG-4 Children's Data, DPIA, and Privacy by Design PDPASG-5 Protection, Accuracy, and Security of Personal Data PDPASG-6 Transfer Limitation, Cross-Border Safeguards, and Data Intermediary Oversight PDPATH-4 DPIA, Privacy by Design, Children's Data PDPATH-5 Security Measures and Data Protection PDPATH-6 Cross-Border Transfer and Processor Engagement PDPATH-7 DPO, Records of Processing, Retention, Marketing, Training PDPATH-8 Data Breach Notification, Complaints, Compliance, Enforcement ISMSP-MS-02 Risk Management ISMSP-PI-01 Personal Information Collection ISMSP-PI-04 Cross-Border Transfer ISMSP-SYS-02 Encryption Implementation ISMSP-SYS-04 Vulnerability Management AZ-DPA-12 Article 13 - Cross-border transfer AZ-DPA-14 Article 16 - Liability for violations AZ-DPA-15 Article 17 - Dispute resolution AZ-DPA-6 Article 6 - State regulation in personal data protection UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5) UAE-PDPL-FreeZones Coordination with DIFC, ADGM and sectoral data protection regimes ISO27799-03 Minimum necessary standard enforcement ISO27799-04 Patient data de-identification procedures ISO27799-05 Audit trail for ePHI access ISO27799-06 Security management process and risk analysis 27400-5.4 Data and privacy risks 27400-7.1 Network Security for IoT 27400-7.3 Data minimization and purpose limitation 27400-7.4 Data retention and deletion NISTPF-3 Control-P - Privacy Controls, Data Management, and Disassociated Processing NISTPF-4 Communicate-P - Privacy Notice, Transparency, and Individual Awareness NISTPF-7 Protect-P Maintenance and Protective Technology (PR.MA-P, PR.PT-P) NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) OREGONCPA-3 Consent, Sensitive Data, Children and Teen Protections OREGONCPA-5 Data Protection Assessments, Privacy by Design, Security Practices OREGONCPA-7 Processor Contracts, Cross-Border Transfers, DPAs OREGONCPA-8 Cure Period, Attorney General Enforcement, Training, Compliance Monitoring POPIASA-3 Data Subject Rights (Access, Correction, Objection), Automated Decisions POPIASA-4 Special Personal Information, Children, Information Quality, Documentation POPIASA-5 Security Safeguards, Encryption, Access Control, Operator Obligations POPIASA-7 Information Officer, Records of Processing, Notification, Training PERU-2 Consent, Privacy Notice, Sensitive Data PERU-3 Data Subject Rights (ARCO), Habeas Data, Automated Decisions PERU-5 Security of Personal Data and Processor Agreements PERU-7 DPO, Records, Retention, Marketing, Training PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 PIPA-Cross-Border-Transfer-Articles-28-8-28-9-Adequacy-Standard-Contract-Certification-EU Korea PIPA Cross-Border Transfer + Articles 28-8 + 28-9 + Adequacy + EU 2021 PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37 PIPA-Pseudonymisation-Article-28-2-3-Enforcement-PIPC-Investigation-Surcharges-3-Percent-Revenue-Article64-2 Korea PIPA Pseudonymisation + Article 28-2 + Enforcement + PIPC + Surcharges 3% + Article 63 + 64-2 APPI-A23 Security Control Measures APPI-A24 Supervision of Employees APPI-A33 Request for Disclosure of Retained Personal Data AL-DPA-12 International Data Transfers AL-DPA-14 Direct Marketing AL-DPA-7 Right of Access APP-1 APP 1 - Open and transparent management of personal information APP-3 APP 3 - Collection of solicited personal information APP-5 APP 5 - Notification of the collection of personal information BSI-13 Risk assessment procedures BSI-15 Security categorization BSI-17 Continuous monitoring strategy ISO-25012-5.1 Establishing data quality requirements ISO-25012-5.2 Defining data quality measures ISO-25012-5.3 Planning and performing data quality evaluations 27011-5.2 Information Security Roles in Telecoms 27011-6.3 Awareness and Training 27011-8.6 Data protection and backup 27557-3 Terms and definitions 27557-4.3 Individual impact consideration 27557-6.3 Privacy risk assessment 29100-6.10 Information security 29100-6.5 Use, retention and disclosure limitation 29100-6.9 Accountability 29134-1 Scope 29134-3 Terms and definitions 29134-9.1 PIA report structure IM8-DAT.2 Data Protection IM8-DAT.4 Data Retention and Disposal IM8-SEC.4 Vulnerability Management API1164-07 Remote Access API1164-24 Vulnerability assessment for critical systems AWWA-1.2 Risk Assessment AWWA-3.4 Encryption and Data Protection DIQ-2 Data Quality Management DIQ-3 Metadata Management IS.D.OR.205 Information Security Risk Assessment IS.I.OR.205 Information Security Risk Assessment FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques) Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A) ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18) ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain IEC62443-07 Personnel risk assessment IEC62443-24 Vulnerability assessment for critical systems ISO27003-6.1 Actions to address risks and opportunities ISO27003-8.2 Information security risk assessment ISO27019-07 Personnel risk assessment ISO27019-24 Vulnerability assessment for critical systems NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management NRFCS-2 Risk Assessment, Customer Data Inventory, Classification, and Retail Threat Model NDPA-1 Applicability, Scope, and Carve-Outs NDPA-4 Sensitive Data Processing Consent and Childrens Protections OECDAI-3 Robustness, Security, Safety, and Adversarial Attack Protection OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation ORSA-S1 Guidance Manual Section 1: Description of the insurer's risk management framework ORSA-S2 Guidance Manual Section 2: Insurer's assessment of risk exposures RUSPD-1 Scope, Definitions, Principles under 152-FZ RUSPD-4 Special Categories, Biometric Data 2.4.4 Hazard Analysis and Risk Assessment 2.7.2 Food Fraud Plan TURKEYKVKK-2 Information Notice and Data Subject Rights TURKEYKVKK-3 Special Categories and Sensitive Data CRM-1 AML/CFT Compliance CRM-4 Business Risk Assessment D.1 Incident Response Planning UKDEFSTD-1 Cyber Defence Cyber Risk Profile (CRP) CPSC-CS.3 Data Protection for Safety Systems CPSC-RA.3 Lifecycle Risk Assessment USMCADIGITAL-1 Cross-Border Data Flows and Localisation USMCADIGITAL-2 Personal Information Protection and Consumer Protection VERMONTAICDA-3 Bias Testing, Discrimination Prevention, Transparency VERMONTAICDA-4 Vermont AG Enforcement and Cure VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) VIETNAMCYBER-4 Incident Reporting and Cooperation AMLCTF-PartA-RiskAssess ML/TF Risk Assessment CPS230-11 Identification, Assessment and Management of Operational Risk ASD37-27 Outbound data loss prevention (Very Good) 4.3.1 Risk Assessment and Impact Analysis DS-2 Ensure software supply chain security CPG-3.C Strong and Agile Encryption CA-10 Selects and Develops Control Activities ISO-22313-8.2 Business impact analysis and risk assessment ISO-26000-6.7 Consumer issues ISO-26262-3-7 Hazard analysis and risk assessment (HARA) 27031-7.2 Resource Requirements 29147-5.11 Researcher Safe Harbour and Legal Posture NFPA1600-5.1 Risk Assessment OECDMNE-5 Environment, Climate, and Biodiversity OMANCS-4 Data Protection, Cryptography, and Privacy Alignment PARAGUAY-5 Security of Processing, Data Integrity, Information Security EHDS-HOLD-3 Dataset Descriptions and Catalogues RIDTPPA-2 Consumer Rights (Access, Correction, Deletion, Portability, Opt-Out) TEFCAREC-1 Common Agreement Conformance and Onboarding Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 296 it maps to, and the evidence behind each claim, over MCP and REST.