APAC cybersecurity and privacy compliance frameworks: the complete guide

Australia Essential Eight

Mandatory for Australian federal government agencies. Widely adopted as a practical baseline across the private sector, particularly by organisations supplying to government or seeking to meet APRA expectations for technical controls.

Organisations self-assess at ML2 because they have the policies in place. The actual technical controls are not implemented uniformly. Application control is configured on SOE workstations but not on servers. Privileged access workstations exist in the policy but not in the infrastructure. In our assessments, the gap between stated and actual Essential Eight maturity averages 1.2 maturity levels across the eight controls (Vulnox assessment data, 2024).

Eight specific mitigation strategies — application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, and regular backups — each rated across three maturity levels. The maturity model is the key implementation detail. Maturity Level 1 is the floor, not the target. Most auditors expect at least ML2 for government suppliers; ML3 for systems handling sensitive data. The framework is unusually concrete: it specifies what ''patching within 48 hours'' means for internet-facing services versus internal systems.

For Australian government agencies, non-compliance is reported through the annual cyber uplift reporting mechanism to the Australian Signals Directorate (ASD). For private sector organisations, there is no direct enforcement mechanism — the consequences are commercial (contract loss, failed supplier assessments) and regulatory (APRA uses Essential Eight performance as an indicator in CPS 234 assessments).

The Essential Eight is the technical control backbone for CPS 234 compliance in Australia. It also satisfies a material portion of NZ NZISM technical requirements for organisations operating across the Tasman. It does not address data privacy, prudential risk management, or operational resilience — CPS 230 covers the resilience gap.

Australia ISM June 2024

Australian government departments, agencies, and their ICT service providers. The ISM is the detailed technical companion to the Essential Eight — where the Essential Eight is the baseline, the ISM is the full control catalogue.

Outdated authorisation packages. A system gets authorised, then the ISM updates, and no one revisits the authorisation for 18 months. Configuration drift means the implemented controls diverge from the documented ones. The authorisation process is treated as a project deliverable rather than a continuous state.

Over 800 security controls organised across 20 domains including governance, physical security, personnel, systems, and communications. Controls are classified as mandatory or should-based. Government system authorisation requires mapping the system against relevant ISM controls and documenting risk acceptance for those not implemented. The June 2024 edition strengthened controls around cloud services, software supply chain security, and AI system integrity.

Agencies must achieve and maintain Protective Security Policy Framework compliance, which references the ISM. System authorisation decisions are made by Authorising Officers (typically SES Band 1 or equivalent). Loss of system authorisation means the system cannot operate legally within the government environment.

The ISM is more granular than the Essential Eight but covers similar technical ground. For New Zealand government suppliers, NZISM maps closely to ISM and the two can be addressed through a shared control framework. For private sector organisations, the ISM is generally not the starting point — the Essential Eight is.

Australia Prudential Standard CPS 230

All APRA-regulated entities: banks, insurers, superannuation funds. Came into effect July 2025. This is the newer and broader of the two APRA standards — it addresses operational risk management holistically, not just information security.

Entities that complied with the pre-CPS 230 guidance documents — PPG 231 and PPG 234 — assumed continuity. CPS 230 materially raised the bar on scenario testing, critical operations documentation, and supplier oversight. The most common gap we see is third-party risk programmes that conducted due diligence at onboarding and have not re-assessed high-criticality suppliers since.

Entities must maintain a register of critical operations and tolerable disruption thresholds for each. Business continuity plans must be tested against realistic scenarios, not just documented. Third-party service provider arrangements must include contractual provisions giving APRA inspection rights and must be subject to ongoing oversight — not just initial onboarding questionnaires. Scenario testing must include severe but plausible events, including cyber events that disable critical systems for extended periods.

APRA has broad powers including issuing enforceable undertakings, applying increased capital buffers, and restricting business activities. CPS 230 non-compliance in the context of an operational failure that harms policyholders or depositors will attract serious regulatory attention. APRA''s supervisory posture has shifted toward proactive testing rather than post-incident review.

CPS 230 sits above CPS 234 in the compliance stack. CPS 234 addresses information security capability. CPS 230 addresses whether the organisation can continue operating when that security capability fails. Both are mandatory for APRA-regulated entities. An entity fully compliant with CPS 234 may still have material CPS 230 gaps around critical operations documentation and testing.

Australia Prudential Standard CPS 234

Banks, insurers, superannuation funds, and all other APRA-regulated entities. Has been in force since 2019. The board retains ultimate responsibility for information security under CPS 234 — not the CISO, not the CRO.

The board responsibility requirement is routinely satisfied on paper. The board receives a security dashboard. The dashboard shows green because the metrics are lag indicators. The first time a board receives real-time notification of a material weakness is during an incident, when the control environment has already failed.

Entities must maintain information security capability proportional to their information asset risks, including through third parties. The board must be notified of material information security control weaknesses. APRA must be notified within 72 hours of a material information security incident. Third-party arrangements must ensure the entity retains visibility and access rights over assets managed by the third party. Internal audit must review the information security control framework at least annually.

APRA has issued public enforcement actions against regulated entities for CPS 234 failures, including against a major Australian bank. Financial penalties, supervisory overlays, and public censure are all available. The 72-hour notification obligation means there is no grace period for deciding whether a breach is material enough to report.

CPS 234 is the information security layer; CPS 230 is the operational resilience layer. Together they represent APRA''s full expectation for a regulated entity''s cyber and operational posture. The Essential Eight covers a significant portion of CPS 234''s technical control expectations. Entities building toward CPS 234 compliance should start with Essential Eight implementation, then layer the governance and third-party requirements on top.

Australian Privacy Principles (APPs)

APP entities — most private sector organisations with annual turnover above AUD 3 million, all government agencies, all health service providers regardless of size, and other specified categories including private schools and contractors to government.

APP 8 cross-border disclosure handling. Organisations use AWS or Azure and assume a Data Processing Agreement covers the cross-border disclosure requirement. It does not unless the DPA specifically binds the provider to act consistently with the APPs and the organisation has assessed the adequacy of protections in the relevant jurisdiction.

13 principles covering the full personal information lifecycle: open and transparent management, anonymity and pseudonymity, collection of solicited personal information, handling of unsolicited information, notification at collection, use and disclosure, direct marketing, cross-border disclosure, adoption of government identifiers, quality of information, security, access, and correction. APP 8 (cross-border disclosure) is the most technically complex — it requires entities to take reasonable steps to ensure overseas recipients handle the information in line with the APPs, or else the Australian entity remains accountable for breaches by the recipient.

The Office of the Australian Information Commissioner (OAIC) investigates complaints and can make binding determinations including compensation orders. Civil penalty provisions for serious or repeated interferences with privacy can reach AUD 50 million for corporations. The Privacy Act reform process underway may significantly increase penalties.

The APPs are the substance of the Privacy Act 1988. They operate together. For the purposes of this group, the Privacy Act is the legislative instrument and the APPs are the practical obligations. Both are listed because the Privacy Act also contains the NDB scheme, which sits outside the APPs but creates its own notification obligations.

Australia Privacy Act

Same scope as the APPs. The Privacy Act is the enabling legislation. Its relevance beyond the APPs lies in the Notifiable Data Breaches (NDB) scheme, which requires entities to notify affected individuals and the OAIC when a data breach is likely to result in serious harm.

''Serious harm'' assessment is conducted by legal counsel alone, without input from technical teams who can assess actual data exposure and likely attacker intent. Decisions to not notify are sometimes made to protect reputation rather than because serious harm is genuinely unlikely. OAIC has become less tolerant of delayed notifications.

The NDB scheme requires notification to the OAIC as soon as practicable after the entity becomes aware of the eligible data breach, and simultaneous notification to affected individuals (or a statement on the website if individual notification is not reasonably practicable). The assessment of whether a breach is ''likely to result in serious harm'' must be conducted promptly — the Act does not permit indefinite assessment periods. Credit reporting and tax file number provisions add specific obligations in those contexts.

Same as APPs — OAIC enforcement, with civil penalties available. The NDB scheme has teeth: organisations that fail to notify on time or at all face separate penalties. The Privacy Act reform process will likely introduce mandatory data retention limits and stronger cross-border transfer rules.

The NDB scheme under the Privacy Act creates a 72-hour equivalent expectation in practice, aligning roughly with CPS 234''s APRA notification obligation, the Philippines DPA''s 72-hour NPC notification, and Singapore''s PDPA breach notification. The timelines and recipients differ, but the operational response pipeline is shared.

Australia IoT Code of Practice

IoT device manufacturers, retailers, and service providers selling connected consumer devices in Australia. Currently voluntary, but this is the baseline from which mandatory regulation will develop.

Vendors implement the visible principles (password hardening, update mechanisms) and ignore the disclosure and transparency requirements. Vulnerability disclosure policies exist on paper but no one is actually monitoring the disclosure inbox or has a defined response process.

13 principles covering secure-by-default configurations (no universal default passwords), vulnerability disclosure policies, software update mechanisms with defined support periods, secure communications, minimising exposed attack surfaces, and software integrity verification. The ''no universal default passwords'' requirement alone eliminates an enormous class of attack vectors that are still exploitable on deployed devices.

Voluntary. No direct enforcement mechanism exists currently. However, devices that fail to meet these principles and are subsequently involved in a security incident that harms consumers may create product liability exposure under Australian Consumer Law.

Lightest-touch framework in the Australian sub-group. Its significance is forward-looking: as Australia moves toward mandatory IoT security regulation, the Code will become the compliance floor. Organisations building IoT products for the Australian market should treat it as mandatory now.

China Cybersecurity Law (CSL)

Any organisation operating networks or providing online services in China — network operators, platform operators, and critical information infrastructure (CII) operators. Extraterritorial application is limited but the practical scope is extremely broad given how the law defines ''network operator''.

Multinationals treat CSL as a data centre location question and procure domestic China cloud hosting. They then route data through the same IAM platform, logging pipeline, and SIEM they use globally, which moves data out of China without triggering the internal compliance alerts. The data localisation obligation applies to the data, not just the storage.

Network operators must implement security protection obligations, verify user identities with real names for internet access, and cooperate with government cybersecurity and public security authorities. Data generated in China by network operators must be stored in China. Cross-border transfer of personal information and important data requires security assessment. CII operators face enhanced obligations including mandatory security reviews for procuring network products and services, and stricter data localisation.

The Cyberspace Administration of China (CAC), Ministry of Public Security, and sector regulators all have enforcement roles. Penalties range from fines to suspension of operations. The government can require suspension of operations for repeated or serious violations. For CII operators, fines and criminal liability for responsible persons are available.

The CSL is the infrastructure layer of China''s three-law framework. It sits beneath DSL (data classification and economic importance) and PIPL (personal information rights). All three apply simultaneously to a typical multinational operating in China. DNSIP adds a fourth layer for CII operators. CSL cross-border transfer restrictions create direct tension with PIPL''s standard contract mechanism — the assessment process for CSL transfers is separate from the SCC equivalent under PIPL.

China Data Security Law (DSL)

All data processing activities in China and any activities outside China that harm Chinese national security, public interests, or the rights and interests of citizens and organisations.

Organisations wait for published sector-specific ''important data'' catalogues before building their classification system. For most sectors, those catalogues were not finalised as of 2024. The DSL does not require a published catalogue before the obligation applies — organisations are expected to make their own reasonable classification assessments based on the statutory criteria.

Data classification based on importance to national security and economic interests. ''Important data'' and ''core data'' categories face enhanced protection requirements and more restrictive cross-border transfer rules. Organisations must establish data security management systems, conduct risk assessments for certain activities, and cooperate with national security reviews. The classification of what constitutes ''important data'' in specific sectors is still being operationalised through sector-specific guidelines.

CAC and relevant industry regulators. Penalties up to RMB 10 million and suspension of operations for serious violations. Criminal liability for severe cases.

DSL sits between CSL (network-level) and PIPL (personal information-specific). It covers important data that may not be personal information — financial market data, industrial data, geospatial data. A full China compliance programme requires mapping all data categories against all three laws simultaneously.

China DNSIP (Critical Information Infrastructure Protection)

Organisations that may qualify as CII operators across sectors defined by the regulations: energy, finance, transport, water, health, education, and government. The scope of what qualifies as CII is broader than Western equivalents.

Organisations do not self-identify as CII operators even when they should. The criteria for CII status include any infrastructure whose destruction would seriously damage national security or public interest — which captures more organisations than most legal teams initially assess.

CII operators must establish dedicated security management bodies, appoint security management personnel, and conduct annual security reviews and drills. Network products and services procured for use in CII must pass a security review. Important data generated or collected in CII operations must be stored domestically. Cross-border transfer requires a CAC-administered national security review.

Sector regulators determine what qualifies as CII within their sectors. Failure to comply, particularly around procurement reviews and data storage, can result in orders to rectify, fines, and in serious cases suspension of operations.

DNSIP is the CII-specific layer that sits on top of the CSL. Every CII operator must comply with both. For non-CII operators, DNSIP is not directly applicable but is relevant context for understanding what the Chinese government considers critical digital infrastructure.

China Privacy Law (PIPL)

Any organisation processing personal information of individuals in China, regardless of where the processor is located. This is the broadest extraterritorial reach of the China framework — a company with no China presence can still be subject to PIPL if it processes personal information of individuals in China.

Organisations implement PIPL consent mechanisms in their consumer-facing apps and believe they have addressed PIPL. They have addressed the collection layer. They have not addressed the cross-border transfer mechanism for the back-end data flows — particularly HR systems, CRM platforms, and analytics pipelines that move data to global cloud infrastructure outside China.

Lawful bases for processing, including consent, necessity for contract performance, and legal obligation. Explicit consent for sensitive personal information including biometrics, health data, financial information, and location data. Cross-border transfer requires one of three mechanisms: a CAC security assessment (mandatory for large-volume transfers), standard contract filing, or personal information protection certification. Data subject rights including access, correction, deletion, and portability. Organisations processing large volumes must designate a personal information protection officer.

CAC with penalties up to RMB 50 million or 5% of annual revenue. Individuals responsible for serious violations can be fined personally and prohibited from serving as directors or senior managers of relevant organisations.

PIPL''s cross-border transfer rules interact directly with CSL data localisation. An organisation moving data from China to Singapore for processing needs both a PIPL transfer mechanism and, depending on data volumes, a CAC security assessment. The two processes are distinct. Neither the Singapore PDPA nor MAS TRM have provisions that satisfy the China-side obligations.

Hong Kong Personal Data Ordinance (PDPO)

Organisations operating in Hong Kong that collect or process personal data of Hong Kong residents. The PDPO applies to data users — any person who controls the collection, holding, processing, or use of personal data.

Data retention. The PDPO requires that personal data not be kept longer than necessary for the purpose for which it was collected. Organisations maintain data lakes and marketing databases with no retention schedule and no deletion workflow. The problem is structural — no one is responsible for deletion, so it does not happen.

Six Data Protection Principles governing collection (purpose limitation, adequacy), accuracy, retention, use (limitation to notified purposes), security, and data subject access. Mandatory data breach notification was not yet in force as a statutory obligation under the PDPO as of 2024, though the PCPD has issued non-binding guidance. The 2021 amendments to the PDPO introduced criminal offences for doxxing — using personal data to intimidate or cause harm — which is unique in the region.

The PCPD can investigate complaints, issue enforcement notices, and refer cases for prosecution. Financial penalties and imprisonment are available for criminal offences including doxxing. The PCPD''s enforcement activity has increased significantly since the 2021 amendments.

Hong Kong operates under PRC sovereignty but maintains a separate legal system. The PDPO is distinct from PIPL and applies independently. A multinational with operations in both mainland China and Hong Kong needs to address both frameworks separately. There is no mutual recognition or reciprocal adequacy arrangement.

India IT Rules (ITR)

Body corporates in India that collect, receive, possess, store, deal, or handle sensitive personal data or information (SPDI) in a computer resource. The SPDI definition includes passwords, financial data, health data, sexual orientation, and biometric data.

Organisations operating under the assumption that passing an ISO 27001 audit satisfies the ITR security requirement. The ITR requires either ISO 27001 certification or a certified security audit — many organisations have neither. They have a certification scope that covers their data centres but not the application layer where SPDI is actually processed.

A documented information security programme and policies. A designated privacy policy published on the organisation''s website. Consent for collection and use of SPDI, with the right to withdraw consent. Security practices and procedures that must either align with ISO 27001 or an approved international standard, or be certified by an independent auditor. Disclosure obligations if SPDI is negligently disclosed to third parties causing wrongful gain or loss.

The IT Rules operate under the Information Technology Act 2000. Penalties are civil — compensation to affected persons. Criminal liability under the IT Act can apply in aggravated cases. The ITR''s enforcement is expected to diminish over time as the DPDPA 2023 becomes fully operational.

The ITR is the predecessor regime to India''s DPDPA 2023. Both currently apply. The DPDPA will progressively replace the ITR''s privacy-related provisions as implementing rules are notified, but the timeline is uncertain. Organisations in India need to maintain compliance with both simultaneously during the transition period.

India DPDPA 2023

Data fiduciaries — organisations processing digital personal data in India or processing personal data of Indian residents outside India. The Act introduces Significant Data Fiduciary (SDF) status for high-volume or high-sensitivity processors, with enhanced obligations.

Organisations are waiting for the implementing rules before building their DPDPA compliance programme. This is understandable but structurally risky — the consent architecture, breach response pipeline, and data principal rights mechanisms typically take 12 to 18 months to build properly. Organisations that wait for the rules to finalise will be in remediation mode from day one.

Consent-based processing with granular consent items — a single bundled consent is not compliant. Purpose limitation, data minimisation, and storage limitation. Breach notification to the Data Protection Board and affected data principals. Data principal rights including access to information, correction and erasure, grievance redressal, and nomination. SDFs face additional requirements including data protection impact assessments, periodic audits by a Data Protection Officer, and algorithmic accountability measures.

The Data Protection Board of India (DPB) will have adjudicatory powers with penalties up to INR 250 crore (approximately USD 30 million) for a single breach. The DPB has not yet been constituted as of the article date — implementing rules remain pending, creating significant operational uncertainty.

DPDPA will eventually supersede the ITR for privacy obligations. For now, both apply. DPDPA''s consent requirements are more granular than Singapore PDPA and comparable in structure to GDPR — organisations with existing GDPR consent frameworks will find significant overlap, but the lawful bases differ (DPDPA consent is more central, legitimate interests is narrower).

India SEBI CSCRF

All SEBI-regulated entities: stock exchanges, clearing corporations, depositories, stockbrokers, depository participants, mutual funds, portfolio managers, investment advisers, and KRAs. The framework uses a tiered compliance model based on entity size and systemic importance.

Annual cybersecurity audits that are conducted as point-in-time assessments against a checklist, submitted to SEBI, and then not acted upon. The audit findings sit in a register. The same findings appear in the following year''s audit. SEBI is becoming more aggressive about asking for evidence of remediation, not just evidence of assessment.

A Board-approved cybersecurity policy, designated CISO, annual cybersecurity audits by SEBI-empanelled auditors with results submitted to SEBI, incident reporting to SEBI within prescribed timeframes, third-party cyber risk management with contractual security requirements, and a Security Operations Centre capability either in-house or outsourced. Higher-tier entities face more frequent audit cycles and stricter penetration testing obligations.

SEBI can issue warnings, impose fines, suspend or cancel registrations, and restrict business operations. Enforcement has been increasing — SEBI issued multiple cybersecurity-related enforcement orders between 2022 and 2024.

SEBI CSCRF draws heavily on NIST CSF and ISO 27001. Entities already compliant with those frameworks will find material overlap. The India-specific additions are the tiering model, the SEBI reporting obligations, and the empanelled auditor requirement. The CSCRF also intersects with DPDPA 2023 — investor data held by regulated entities is personal data subject to both.

Japan APPI

Businesses handling personal information in Japan and foreign companies meeting the threshold for extraterritorial application — generally, those offering goods or services to Japanese residents or monitoring their behaviour.

Cross-border transfer management. The APPI cross-border transfer rule requires either the recipient country meets ''equivalent standards'' or the organisation implements contractual measures to ensure equivalent protections. Many organisations route data to global cloud platforms and either do not document the transfer basis or rely on DPAs that do not meet the APPI contractual standard.

Purpose specification at collection, restriction of use to notified purposes, security management measures (including appropriate technical and organisational controls and employee supervision), restriction on third-party provision without consent except under the opt-out regime, stricter rules for sensitive information categories, mandatory breach notification to the PPC and affected individuals for breaches meeting specified criteria, cross-border transfer restrictions requiring adequacy assessment or binding contractual protections.

The Personal Information Protection Commission (PPC) can issue recommendations and orders. Non-compliance with orders is a criminal offence. The PPC has accelerated enforcement since 2022 — its prior reputation for leniency has changed. Fines of up to JPY 100 million for corporations.

Japan APPI and Korea PIPA are the two most mature and actively enforced privacy laws in Northeast Asia. APPI''s breach notification obligation — notify the PPC within approximately 3 to 5 days of discovery — is more demanding operationally than most APAC equivalents. Japan ISMAP is a separate framework entirely, concerned with government cloud procurement rather than personal data protection.

Japan ISMAP

Cloud service providers seeking to sell to Japanese government agencies. Registration is mandatory for government procurement. The ISMAP assessment evaluates the CSP''s control environment against security requirements derived from ISO 27001 and related standards.

ISO 27001 certification holders assume ISMAP is a fast-track. It is not. ISMAP has approximately 300 additional control requirements beyond ISO 27001, particularly around government-specific security classifications, audit evidence standards, and incident reporting to government CERTs. The assessment timeline is typically 6 to 12 months.

An ISMAP assessment by an ISMAP-registered audit organisation, mapping the cloud service''s controls against the ISMAP management criteria, which exceed 1,000 controls across 14 management domains. Registration must be renewed annually. The assessment covers the specific cloud service being registered — a vendor with multiple cloud services must register each separately.

Procurement exclusion. Government agencies cannot purchase cloud services from providers not on the ISMAP register. No fines or penalties — the consequence is commercial.

ISMAP is orthogonal to APPI. One covers government cloud procurement; the other covers personal data protection. A cloud vendor targeting the Japanese government market needs both. There is no crossover benefit — ISMAP registration does not satisfy APPI obligations, and APPI compliance does not satisfy ISMAP requirements.

Malaysia PDPA

Organisations engaged in commercial transactions in Malaysia that collect, process, or store personal data. The ''commercial transaction'' limitation excludes some government and non-profit processing, but covers the vast majority of corporate entities.

The security principle is interpreted as an IT security question and delegated entirely to the IT department. Practical steps are equated with ''whatever we have deployed.'' No one has assessed whether the deployed controls are adequate relative to the sensitivity of the data being processed and the risk of the processing activities.

Seven data protection principles: general principle (lawful processing), notice and choice, disclosure, security, retention, data integrity, and access. Data subject rights including access, correction, and withdrawal of consent. Security principle requires organisations to take practical steps to protect personal data from misuse, loss, unauthorised access, modification, or disclosure. Malaysia is updating the PDPA to strengthen rights, introduce breach notification obligations, and impose financial penalties — amendments are expected to modernise the Act significantly.

The Department of Personal Data Protection (JPDP) can prosecute violations. Current penalties cap at MYR 500,000 and three years imprisonment per offence. The pending PDPA amendments are expected to substantially increase penalties and add mandatory breach notification.

Malaysia PDPA is currently one of the lighter-touch privacy frameworks in APAC, but the pending amendments will close most of the gap with Singapore PDPA and GDPR-aligned frameworks. Organisations should build toward the amended standard, not the current one.

New Zealand HISF 2022

New Zealand district health boards, primary health organisations, and private health providers handling patient information. The framework is sector-specific — it addresses the particular risk profile of health data in clinical settings.

Clinical systems vendors not covered by the HISF Suppliers framework being treated as low-risk. The patient data the vendor accesses is not low-risk regardless of the vendor''s size. Many small clinical software vendors — EPR add-ons, telehealth platforms, patient engagement apps — have direct access to sensitive patient records and no formal security assessment has ever been conducted.

Security controls mapped to the health sector context: governance and risk management appropriate for clinical environments, access control calibrated for clinical workflow (break-glass access, emergency access controls), incident management with clinical safety implications, business continuity that accounts for patient safety dependencies, and third-party management for clinical IT vendors.

The Ministry of Health (now Te Whatu Ora / Health New Zealand) published the HISF as guidance. Compliance is expected as a condition of operating within the health system. Non-compliance can affect procurement decisions and, in the event of a breach, regulatory exposure under the NZ Privacy Act 2020.

HISF 2022 covers health sector organisations; HISF Suppliers 2023 covers their technology vendors. Both are required for a complete supply chain security posture in the NZ health sector. NZISM is the broader government security standard and provides a compatible control framework — health sector organisations can use NZISM as their base and add HISF-specific controls on top.

New Zealand HISF Suppliers 2023

Technology vendors, cloud providers, and IT service companies supplying solutions to New Zealand health sector organisations. This is the supply chain extension of the HISF framework.

Suppliers produce a self-assessment against the HISF Suppliers requirements and submit it as evidence of compliance. No independent verification. The self-assessment reflects what the supplier believes its controls to be, not what an assessment would find. In our experience, self-assessed compliance overstates actual compliance by approximately 30% for smaller vendors (Vulnox assessment data, 2024).

Minimum security expectations that suppliers must demonstrate compliance with, covering the same domains as the HISF: governance, risk management, access control, incident management, and business continuity. Suppliers must be able to evidence compliance to their health sector customers — the framework supports supplier assessment and onboarding processes.

No direct regulatory enforcement against suppliers. The consequence is commercial — health sector organisations use this framework to qualify suppliers, and non-compliant suppliers face procurement exclusion.

HISF Suppliers is the third-party risk management mechanism for the NZ health sector. It parallels CPS 234''s third-party requirements in Australia and MAS TRM''s vendor management obligations in Singapore — each sector has built its own third-party security assurance model because no cross-sector APAC standard exists for this.

New Zealand NZISM 3.6

New Zealand government agencies (mandatory) and their ICT service providers and suppliers. NZISM is the NZ government''s equivalent of Australia''s ISM — a detailed security control catalogue.

Legacy systems that were accredited under an earlier NZISM version and have never been reassessed against current requirements. Configuration drift means the accredited state and the current state diverge, but no one triggers a reaccreditation because the system is still operating.

Controls across 20+ security domains, classified into mandatory and should-based requirements. System classification and security accreditation processes. The GCSB publishes NZISM and has authority over government agency compliance. Version 3.6 included updates to cloud security, supply chain security, and cryptography requirements.

Agencies must comply as a condition of operating government systems. The GCSB oversees compliance. ICT suppliers to government must meet NZISM requirements as a procurement condition.

NZISM and Australia ISM are the two government security manuals in the Australasian sub-group. They address similar control domains but are not harmonised — a cross-Tasman supplier cannot use Australian ISM compliance as a substitute for NZISM compliance. The frameworks reference each other and share structural similarities, but the specific control requirements differ.

New Zealand Privacy Act 2020

All public and private sector agencies in New Zealand that collect or hold personal information about individuals in New Zealand. No turnover threshold — unlike Australia, the New Zealand Act applies regardless of organisational size.

Breach notification threshold assessment. Organisations conduct ''significant harm'' assessments informally and under time pressure, often deciding not to notify because the harm is not ''certain.'' The Act requires notification when significant harm is ''reasonably likely'' — a lower threshold than certainty. Under-notification is a structural problem.

13 Information Privacy Principles covering collection, source, notice, manner of collection, storage and security, access, correction, accuracy, retention, use and disclosure, and unique identifiers. Mandatory data breach notification to the Privacy Commissioner when a notifiable privacy breach has occurred or is reasonably believed to have occurred — threshold is ''significant harm'' to affected individuals. The Privacy Commissioner has new compliance notice powers.

The Privacy Commissioner can investigate complaints, issue compliance notices, and refer serious cases to the Human Rights Review Tribunal. Damages awards available. The absence of a turnover threshold means small organisations are also subject to enforcement.

The NZ Privacy Act and Australia Privacy Act are the legislative privacy frameworks for their respective jurisdictions. Both include breach notification obligations with different thresholds and different notification processes. Organisations operating in both markets need to run both notification assessments in parallel when a breach occurs.

Philippines Data Privacy Act

Organisations operating in the Philippines or processing personal data of Filipino residents. Mandatory appointment of a Data Protection Officer for organisations with 250+ employees or those processing sensitive personal information.

DPO appointment as a compliance checkbox. The appointed DPO has no authority, no budget, and no staff. They are typically a legal or compliance officer with DPO added to their title. The DPA requires the DPO to have sufficient authority to effectively monitor the organisation''s DPA compliance — nominal appointment does not satisfy this.

Principles of transparency, legitimate purpose, and proportionality govern all processing. Security measures must be appropriate to the nature and scope of processing. Breach notification within 72 hours of discovery to the National Privacy Commission (NPC). NPC registration of data processing systems is required for some categories. Data subject rights including access, rectification, erasure, objection, and data portability.

The NPC can investigate, issue compliance and cease-and-desist orders, and refer criminal cases to the Department of Justice. Criminal penalties including imprisonment of up to six years and fines up to PHP 5 million are available. The NPC has been active in enforcement and has published breach notification decisions that signal its expectations.

Philippines DPA''s 72-hour NPC notification obligation is the most demanding breach notification timeline in the APAC privacy law sub-group, matching Australia''s practical NDB expectation and Singapore''s PDPA 3-day mandatory breach notification. The Philippines'' mandatory DPO requirement is more prescriptive than Australia or New Zealand — DPOs are required for specific organisation types, not just as a best practice.

Singapore PDPA

Private sector organisations in Singapore that collect, use, or disclose personal data of individuals. Government agencies are excluded from PDPA and covered by the Public Sector (Governance) Act.

The 3-day breach notification window is commonly misunderstood as beginning when the breach occurs. It begins when the organisation ''assesses'' the breach as notifiable — which requires completing an assessment. Organisations that conduct extended forensic investigations before completing the notification assessment can find themselves outside the window before they realise it.

Consent, purpose limitation, notification, access and correction, accuracy, protection, retention limitation, transfer limitation, and openness obligations. The 2021 amendments added mandatory breach notification to the PDPC within 3 days of assessing that a data breach is notifiable, expanded grounds for legitimate interests (removing consent requirement in specific circumstances), and increased maximum financial penalties to SGD 1 million or 10% of annual Singapore turnover, whichever is higher.

The PDPC has imposed penalties on multiple organisations including a SGD 750,000 fine on a major Singapore organisation following a significant breach. The 10% of Singapore turnover cap introduced in 2021 materially increased the financial exposure for larger organisations.

Singapore PDPA and MAS TRM operate simultaneously for MAS-regulated financial institutions in Singapore. The PDPA covers personal data protection obligations; MAS TRM covers technology and cyber risk management at the institutional level. A breach at a Singapore bank triggers both the PDPA notification to PDPC and the MAS incident reporting obligation.

Singapore Cyber Hygiene Practice

Primarily SMEs and organisations in Singapore seeking a baseline cybersecurity starting point. The CSA positions this as the entry-level framework, with Cyber Essentials and Cyber Trust marks representing higher levels of assurance.

Organisations implement the hygiene controls in isolation from any risk context. Anti-malware is deployed but the backup regime has never been tested. MFA is enabled on email but not on the VPN. The controls are treated as a list to check rather than a coherent defensive posture.

Foundational controls: keep software updated, use strong authentication, control system access, use anti-malware, secure internet-facing systems. The framework is intentionally accessible — it does not require technical expertise to understand, which is its primary design objective.

No direct enforcement. Commercial and reputational consequences — particularly for suppliers to organisations that require evidence of a minimum security baseline.

Singapore Cyber Hygiene Practice is the floor for Singapore''s tiered framework architecture. It feeds into Cyber Essentials, which feeds into Cyber Trust. MAS TRM sits separately as a sector-specific regulatory requirement. Organisations regulated by MAS cannot satisfy TRM obligations through Cyber Hygiene compliance alone.

Singapore MAS TRM 2021

All MAS-regulated financial institutions: banks, insurers, payment institutions, capital market intermediaries. The TRM Guidelines are not binding law but MAS supervises compliance and expects full adoption.

Red team exercises that are not adversarial. The same security team that operates the controls designs and conducts the test. Results confirm that controls work as designed. That is not a red team exercise — it is a validation exercise. MAS TRM requires independent adversarial testing, and the distinction matters.

Board and senior management accountability for technology risk. Cyber surveillance capabilities — continuous monitoring of systems for anomalies. Penetration testing conducted by suitably qualified practitioners. Third-party technology risk management including security assessments of critical vendors and contractual rights of audit. System resilience requirements including recovery time objectives. Incident reporting to MAS for significant technology incidents. The 2021 update added stronger requirements on software supply chain security, adversarial attack simulation (red teaming), and cyber threat intelligence.

MAS uses supervisory toolsets including requiring remediation plans, imposing enhanced monitoring, and in serious cases restricting business activities. MAS has publicly named and taken action against regulated entities with material technology risk deficiencies.

MAS TRM is the most detailed cyber risk management framework in the Singapore sub-group. Singapore PDPA and Cyber Hygiene Practice both apply alongside it to regulated entities. Internationally, MAS TRM aligns structurally with APRA CPS 234 — both are prudential regulator expectations for financial institution cyber posture, and a cross-Tasman financial institution can build a unified control framework that satisfies both.

South Korea PIPA

Public and private sector organisations processing personal information of Korean residents. One of the world''s most stringent data protection laws in terms of both substantive requirements and penalty exposure.

The explicit consent requirement. Korean law requires that consent to personal information processing be separate from consent to terms of service, and that each purpose of use be individually consented to. Organisations that bundle consent into a single checkbox during onboarding are non-compliant from the moment the first Korean user signs up.

Explicit consent for collection and use, granular consent items separate from other contractual terms, heightened protections for sensitive information categories (political and religious beliefs, trade union membership, genetic and biometric data, health and sexual orientation data). Mandatory appointment of a Chief Privacy Officer for organisations meeting size or data volume thresholds. Pseudonymisation obligations for research and statistical processing. Breach notification to the PIPC and affected individuals within 72 hours. Data destruction when retention purpose expires.

The PIPC has authority to impose fines up to 3% of annual revenue for serious violations. Criminal penalties including imprisonment for up to five years are available. Korea has imposed criminal charges on executives of organisations that suffered data breaches — this is not a theoretical risk.

South Korea PIPA is the strictest personal data protection law in the APAC group, with the highest potential penalties and the most granular consent requirements. Organisations that build their global privacy programme to satisfy South Korean requirements will find every other APAC privacy framework easier to satisfy — it is the ceiling, not the floor.

Taiwan PDPA

Public and private sector organisations in Taiwan and foreign organisations processing personal data of Taiwan residents.

Sector-specific guidance overlooked. Organisations map to the PDPA Act itself but not the additional requirements from their sector regulator. For financial institutions, the Financial Supervisory Commission has issued PDPA guidance that materially extends the base Act obligations.

Lawful bases for processing, purpose limitation, security obligations, data subject rights (access, correction, deletion, objection, portability), and cross-border transfer restrictions. Taiwan''s sector regulators (financial, health, and others) have issued industry-specific PDPA guidance that adds requirements beyond the Act itself.

Sector regulators and the Ministry of Justice oversee enforcement. Civil damages and criminal penalties up to imprisonment of two years for intentional violations. Taiwan has increased enforcement activity, particularly following high-profile data breaches in the financial sector.

Taiwan PDPA is structurally similar to Japan APPI and the EU GDPR in its approach. Organisations with GDPR compliance programmes will find significant control overlap. The enforcement environment is less mature than Japan or Korea, but that is changing.

CPS 234 requires board-level accountability and quarterly notification of material control weaknesses to the board. It also requires APRA notification within 72 hours of a material incident. Essential Eight has no governance or notification layer. A fully ML3-compliant Essential Eight implementation with no CPS 234 governance structure is still non-compliant with CPS 234.

Technical information security controls. Essential Eight ML3 implementation covers application control, privileged access management, MFA, and patching — all areas CPS 234 requires regulated entities to maintain capability proportional to risk. An APRA-regulated entity at Essential Eight ML3 has satisfied the majority of CPS 234''s technical control expectations without additional work.

The notification thresholds differ materially. Philippines uses ''significant harm'' as the assessment standard. Singapore uses ''significant scale'' or ''significant harm.'' Australia requires ''likely to result in serious harm.'' New Zealand requires ''significant harm.'' These are not equivalent. A breach that triggers notification under Philippines rules may not meet the Australia ''serious harm'' threshold, and vice versa. Organisations with exposure in multiple markets cannot use a single notification threshold — they need jurisdiction-specific assessments running in parallel.

Breach notification obligations. All four require notification to a regulatory body when a qualifying breach occurs, with timelines ranging from 72 hours (Philippines NPC) to 3 days (Singapore PDPC) to ''as soon as practicable'' (Australia OAIC, NZ Privacy Commissioner). All four require individual notification in parallel. The underlying breach response process — detection, assessment, documentation, regulatory notification, individual notification — is shared across all four.

The cross-border transfer mechanisms under each law are separate processes. PIPL requires standard contracts, security assessments, or certification — each through a defined CAC process. CSL requires a security assessment for certain categories of important data for network operators. DSL has its own cross-border restriction for important data. Transferring data from a China operation to a global data centre can trigger all three transfer mechanisms simultaneously, each requiring a separate regulatory filing or assessment.

Data handling in China. All three impose obligations on data-related activities in China. All three apply simultaneously. The security management obligations under CSL, the classification and risk assessment requirements under DSL, and the consent and transfer mechanisms under PIPL all need to be satisfied concurrently for a typical China operation.

MAS TRM requires specific adversarial attack simulation (red teaming) and cyber threat intelligence capability that CPS 234 does not explicitly mandate. CPS 234 requires APRA notification within 72 hours; MAS TRM notification to MAS uses different criteria and timelines. The audit and evidence standards differ — APRA has published detailed expectations for the internal audit review; MAS TRM is less prescriptive on audit methodology.

Technology risk management for financial institutions. Both require board accountability, third-party risk management with audit rights, incident reporting to the prudential regulator, and security controls proportional to risk. A cross-Tasman financial institution can build a unified control framework that satisfies both — the control overlap is approximately 70%.

Treating the APAC group as a single compliance programme

Compliance teams with EU GDPR experience assume that one anchor framework covers the region the way GDPR anchors Europe. There is no APAC equivalent of GDPR. The APAC group does not have a single cross-jurisdictional authority, no mutual recognition framework, and no adequate country determinations equivalent to the EU adequacy list. Treating it as a single programme creates gaps in every jurisdiction.

Organisations pass their primary framework assessment (typically ISO 27001 or Singapore PDPA) and believe the region is covered. They discover the gaps through regulatory inquiry, contract loss to competitors who demonstrate jurisdiction-specific compliance, or an incident that triggers notification obligations under frameworks they did not know applied to them.

Mapping compliance against framework text rather than enforcement reality

Framework text is what compliance teams can access and document. Enforcement reality — what regulators actually investigate, what evidence they request, what they consider adequate — is distributed across enforcement decisions, regulatory guidance, and assessor experience. Most compliance programmes are built against the text and never calibrated against enforcement practice.

A programme that satisfies the text of the Australia Privacy Act may not satisfy the OAIC''s current expectations for breach notification timeliness. A programme that satisfies the text of PIPA may not satisfy the PIPC''s current expectations for consent granularity in mobile applications. The gap between text compliance and enforcement compliance is where the regulatory exposure lives.

Assuming CPS 230 is a cybersecurity uplift to CPS 234

Both standards are APRA standards. Both are about information and technology risk. CPS 230 came after CPS 234. The natural assumption is that CPS 230 is the next level of CPS 234.

CPS 230 is an operational risk management standard, not an information security standard. Its requirements around critical operations registers, scenario testing, and third-party oversight extend well beyond cybersecurity. An entity that responds to CPS 230 with an enhanced information security programme while ignoring the operational resilience and business continuity requirements has missed most of what CPS 230 actually requires.

Treating China''s three-law framework as a single ''China compliance'' problem

Legal teams receive questions about China data regulations and produce a single briefing document. The briefing describes CSL, DSL, and PIPL as layers of a single framework. Compliance teams then build a single compliance programme for ''China.'' The three laws have different objects, different enforcement bodies, different transfer mechanisms, and different penalty regimes. A unified compliance programme that does not separately address each law''s distinct requirements will have gaps under at least one of them.

The most common consequence is an unaddressed PIPL cross-border transfer obligation. The compliance programme addressed CSL data localisation (by procuring domestic cloud hosting) and addressed general security requirements, but the product analytics, CRM, and HR system data flows — which move personal information out of China daily — have no documented PIPL transfer basis and no CAC filing.