Schedule 1 Part 5 (item 34) adds APP 11.3: the reasonable steps an APP entity must take under APP 11.1 (protecting personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure) and APP 11.2 (destroying or de-identifying information no longer needed) include technical and organisational measures. Item 35: it applies to information held after 11 December 2024, whenever acquired or created.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.