Australia Privacy Act

Australian Privacy Principles: data handling software inventory, processor accountability.


Short name	AUS Privacy
Region	Asia-Pacific
Country or scope	Australia
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers AUS Privacy

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for AUS Privacy.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for AUS Privacy and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`AU-APP-11` Security of Personal Information	Entities must take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, which for software systems includes integrity assurance of the processing components (Privacy Act 1988, Schedule 1, APP 11.1)	Scan
`AU-APP-1` Open and Transparent Management	Entities must manage personal information in an open and transparent way, implying documented, identifiable records of the systems that process it (Privacy Act 1988, Schedule 1, APP 1.2)	Scan
`AU-APP-INV` Processing System Inventory	Reasonable steps to implement practices, procedures and systems that ensure APP compliance require knowing which software components handle personal information (Privacy Act 1988, Schedule 1, APP 1.2)	Scan
`AU-APP-8` Cross-Border Disclosure Accountability	Before disclosing personal information to overseas recipients an entity must take reasonable steps to ensure the recipient complies with the APPs, which requires knowing who supplies each software component in the processing chain (Privacy Act 1988, Schedule 1, APP 8.1)	Scan
`AU-NDB-26WK` Notifiable Data Breach Readiness	The Notifiable Data Breaches scheme requires rapid assessment of suspected eligible data breaches, which depends on being able to identify affected software and its versions (Privacy Act 1988, Part IIIC, s 26WK)	Scan
`AU-APP-11RET` Identifiable Components for Safeguard Review	Ongoing review of security safeguards requires that processing components be unambiguously identifiable against vulnerability and threat information (Privacy Act 1988, Schedule 1, APP 11; OAIC security guidance)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`APP-1`	Establish an Open and Transparent Privacy Policy
`APP-3`	Limit Collection of Personal Information
`APP-5`	Notify Individuals at or Before Collection
`APP-6`	Control Use and Disclosure of Personal Information
`APP-7`	Manage Direct Marketing Communications
`APP-8`	Govern Cross-Border Disclosure of Personal Information
`APP-11`	Secure Personal Information Against Misuse and Loss
`APP-12`	Provide Access to Personal Information on Request
`APP-13`	Correct Personal Information on Request
`NDB-ASSESS`	Assess Suspected Eligible Data Breaches Promptly
`NDB-NOTIFY`	Notify OAIC and Individuals of Eligible Data Breaches
`APP-2`	Anonymity and Pseudonymity Options

Policy templates

Written for AUS Privacy:

Privacy Collection Notice and Transparency Policy
Notifiable Data Breaches Response Policy
Cross-Border Disclosure of Personal Information Policy

And 22 from the standard set, adapted to AUS Privacy.