TEFCA - Trusted Exchange Framework and Common Agreement
Trusted Exchange Framework Principles

TEFCA - Trusted Exchange Framework and Common Agreement TEF-2: Openness and Transparency

Exchange practices must be open and transparent regarding policies, procedures, and data handling practices.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 119 controls across 38 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 5 controls

  • CH-FADP-19 Transparency and proactive information
  • CH-FADP-21 Data protection impact assessments
  • FADP-16 FDPIC Independence and Functions
  • FADP-7 Data Protection Impact Assessment (Articles 9-10)
  • FADP-9 Data Protection Advisor (Articles 14-15)

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 3 controls

  • AT-DSG-10 Section 29 - Liability and right to compensation / civil jurisdiction
  • AT-DSG-12 Section 62 - Administrative penalties
  • AT-DSG-7 Section 18 - Establishment of the Data Protection Authority

GDPR · 3 controls

ISO 27799:2025 · 3 controls

  • ISO27799-03 Minimum necessary standard enforcement
  • ISO27799-04 Patient data de-identification procedures
  • ISO27799-05 Audit trail for ePHI access

ISO/IEC 27011:2024 · 3 controls

  • 27011-5.2 Information Security Roles in Telecoms
  • 27011-6.3 Awareness and Training
  • 27011-8.6 Data protection and backup

NIST SP 800-190 · 3 controls

Uganda Data Protection and Privacy Act (2019) · 3 controls

  • UGA-3 Accountability Principle
  • UGA-6 Personal Data Protection Office
  • UGA-7 Data Protection Officer

Azerbaijan Law on Personal Data (2010) · 2 controls

  • AZ-DPA-15 Article 17 - Dispute resolution
  • AZ-DPA-6 Article 6 - State regulation in personal data protection

Bahrain PDPL · 2 controls

Barbados Data Protection Act 2019 · 2 controls

  • BB-DPA-1 Section 1 - Short Title
  • BB-DPA-4 Section 4 - Principles Relating to Processing

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 2 controls

  • UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10)
  • UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21)

ISO/IEC 27400:2022 · 2 controls

  • 27400-7.1 Network Security for IoT
  • 27400-7.4 Data retention and deletion

Nebraska Data Privacy Act · 2 controls

  • NDPA-1 Applicability, Scope, and Carve-Outs
  • NDPA-4 Sensitive Data Processing Consent and Childrens Protections

Saudi Arabia PDPL · 2 controls

  • SA-PDPL-19 Data protection officer designation
  • SA-PDPL-21 Data protection impact assessments

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 2 controls

  • IM8-DAT.2 Data Protection
  • IM8-DAT.4 Data Retention and Disposal

Sweden Data Protection Act (Dataskyddslag, 2018:218) · 2 controls

  • SWE-1 Scope and Purpose
  • SWE-2 Relationship to GDPR

UK Age Appropriate Design Code (Children's Code) · 2 controls

  • Standard 15 Online Tools
  • Standard 2 Data Protection Impact Assessments

UK GDPR (UK General Data Protection Regulation) · 2 controls

  • UKGDPRREG-2 Data Subject Rights (Articles 12-22)
  • UKGDPRREG-3 Controller and Processor (Articles 24-43)

Uruguay DPL · 2 controls

  • URUGUAY-4 Security and Cross-Border
  • URUGUAY-5 Database Registration with AGESIC URCDP

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-27 Outbound data loss prevention (Very Good)

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

  • AWWA-3.4 Encryption and Data Protection

Albania Law No. 124/2024 on Personal Data Protection · 1 control

  • AL-DPA-14 Direct Marketing

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 1 control

  • CPG-3.C Strong and Agile Encryption

ISO 26000:2010 · 1 control

  • ISO-26000-6.7 Consumer issues

ISO/IEC 23894:2023 · 1 control

  • ISO23894-A.5 Privacy and Data Protection in AI

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 1 control

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

  • SOC-CY-C2 Encryption and Data Protection

South Korea Korea Internet Self-Governance Organisation (KISO) Code of Ethics · 1 control

TISAX - Trusted Information Security Assessment Exchange · 1 control

  • TISAXASS-3 Prototype Protection and Confidentiality

Taiwan PDPA · 1 control

  • TAIWAN-3 Data Subject Rights

Telecommunications Sector Security Reforms (TSSR) · 1 control

  • TSSR-INFO-1 Network Data Protection

Texas Data Privacy and Security Act (TDPSA) · 1 control

  • TEXASTDPSA-3 Sensitive Data, Children, Sale Notice

UK AI Regulation Framework · 1 control

  • UKAI-2 Sector-Specific Regulator Engagement

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 1 control

  • D.1 Incident Response Planning

UNESCO Recommendation on the Ethics of AI · 1 control

  • UNESCOAI-2 Principles 4-7: Sustainability, Privacy, Human Oversight, Transparency

US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties · 1 control

  • CPSC-CS.3 Data Protection for Safety Systems

US ITAR and EAR - Export Control and Data Security · 1 control

  • US-ITAR-EAR-DS-01 Technical Data Protection

Virginia CDPA · 1 control

  • VIRGINIAVCDPA-3 Sensitive Data Consent and Children

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Trusted Exchange Framework Principles

Query this from an agent

The graph holds this control, the 119 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll TEFCA - Trusted Exchange Framework and Common Agreement controls