Question 1

What is Privacy Programme Practices (non-statutory)?

Accepted Answer

Privacy Programme Practices (non-statutory) is a compliance framework from Australia with 1 domains and 7 controls. Operational privacy programme practices that are not obligations under any single statute. Separated from the Australian Privacy Principles on 2026-08-19 because Schedule 1 of the Privacy Act 1988 defines exactly 13 principles and these are not among them. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

Question 2

How many controls does Privacy Programme Practices (non-statutory) have?

Accepted Answer

Privacy Programme Practices (non-statutory) has 7 controls organised across 1 domains. The largest domains are Privacy programme practices (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

Question 3

What frameworks does Privacy Programme Practices (non-statutory) map to?

Accepted Answer

Privacy Programme Practices (non-statutory) maps to 3 other compliance frameworks. The top mapping partners are GDPR (71% coverage), ISO 27701:2019 (14% coverage), Consumer Data Right Rules 2020 (selected operational obligations) (14% coverage). Use our comparison tool to explore control-level mappings between frameworks.

Question 4

How do I get started with Privacy Programme Practices (non-statutory) compliance?

Accepted Answer

Start your Privacy Programme Practices (non-statutory) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Privacy Programme Practices (non-statutory) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 7 controls and track your progress.

Code	Title	Description
COMP	Complaints handling	Maintain a process to receive and handle privacy complaints.
GOV-PO	Privacy officer and accountability	Appoint a privacy officer and establish accountability for privacy management (OAIC Privacy Management Framework).
NDB	Notifiable Data Breaches scheme	Assess eligible data breaches and notify the OAIC and affected individuals as required under the NDB scheme (Part IIIC,...
PIA	Privacy Impact Assessment	Conduct Privacy Impact Assessments for high-privacy-risk projects.
REG	Records of disclosures	Maintain records of disclosures, including cross-border disclosures, as required by the APPs.
TRN	Privacy training and awareness	Provide privacy training and awareness to staff handling personal information.
VEN	Vendor and contracted service provider management	Ensure contracted service providers and vendors handling personal information meet APP obligations.

Privacy Programme Practices (non-statutory)

Framework Domains (1)