Data Protection and You Video: By way of introduction to our office, and in particular to Part Four of the Privacy and Data Protection Act (PDPA) 2014, we have created a video to assist the VPS in understanding their protective data security obligations within Victorian Government.

VPDSF 5 Step Action Plan

VPDSF Applicability Visual

VPDSF Glossary: Glossary of Terms used in the Victorian Protective Data Security Framework 

Embedding security into your organisation

Victorian Protective Data Security Framework V1.1 – March 2018

Victorian Protective Data Security Standards (Text version)

VPDSS Posters: Visual representation of the standards

VPDSS Posters: Visual representation of the standards – How to Read

VPDSS Control Reference Links

Rosetta Stone – Core and Supplementary (V2.0)

VPDSF Information Security Management Collection

• Chapter 1 – Appendix A – Sample questions and example information assets
• Chapter 1 – Appendix C – Information Asset considerations
• Chapter 1 – Appendix D – Suggested Information Management roles and responsibilities
• Chapter 2 – Appendix A – Stages of the information value assessment process
• Chapter 2 – Appendix B – VPDSF Business Impact Level (BIL) Table
• Chapter 2 – Appendix C – BIL Mobile App
• Chapter 3 – Appendix A – Relationship between protective markings
• Chapter 3 – Appendix B – Common protective markings employed by each State and Territory
• Chapter 3 – Appendix C – Ready reckoner: How to select an appropriate protective marking

Sample Information Asset Register (IAR) Template

VPDSF Assurance Collection

• Chapter 1 - Appendix A - Example Security Risk Profile Assessment Template
• Chapter 1- Appendix B - Summary of SRPA Actions
• Chapter 2 - Appendix A - VPDSS Self-assessment Template
• Chapter 2 - Appendix B - Summary of VPDSS Self-assessment Actions
• Chapter 3 - Appendix A - Protective Data Security Plan (PDSP) Template
• Chapter 3 - Appendix B - Summary of PDSP Actions

VPDSS Self Assessment Template

VPDSF Protective Data Security Plan (PDSP) Template DETAILED

VPDSS Elements

To be compliant with the Privacy and Data Protection Act 2014, an organisation must report to OVIC by 31 August 2018 using one of the templates below:

Introductory Letter

Text from the letter from the Victorian Information Commissioner to:

•    Departmental Secretaries

•    Cenitex

•    Victoria Police

dated 26 February 2018

Click here to download

Factsheet - Attestation and Reporting Options

This fact sheet provides information to public sector agencies and bodies about options for submitting a Protective Data Security Plan (PDSP) and providing an attestation for the Office of the Victorian Information Commissioner (OVIC).

The factsheet can also be downloaded here.

Template Option 1 - High Level PDSP (Single Organisation)

An organisation submits a high level Protective Data Security Plan (PDSP) and provides an attestation on its own behalf only (single organisation model). 

Nb. OVIC does not mandate the use of any particular approach, with the selection of either reporting option residing with each organisation.

Click here to download

This template comprises three parts:

Part A:  Agency or Body details

Part B:  Compliance status and key activities (planned or in progress)

Part C:  Attestation

Template Option 2 - High Level PDSP (Multiple Organisations)

An organisation submits a consolidated high level Protective Data Security Plan (PDSP) and provides an attestation on its own behalf, and for and on behalf of one or more additional public sector agencies or bodies (multiple organisation model).

The multiple organisation model may be used in a portfolio setting where agencies or bodies fall within the portfolio of responsibilities of a Department or where a number of organisations of a similar form or function choose to consolidate their efforts.

Nb. OVIC does not mandate the use of any particular approach, with the selection of either reporting option residing with each organisation.

Click here to download

This template comprises three parts:

Part A:  Agency or Body details

Part B:  Compliance status and key activities (planned or in progress)

Part C:  Attestation

Online Portal

OVIC has established an online portal to enable the August 2018 submission of high level Protective Data Security Plans (PDSPs). To submit your high level PDSP, navigate to the Data Protection section of the OVIC website (www.cpdp.vic.gov.au/security).

The portal will be availabile for high level PDSP submission from 1 July 2018 to 31 August 2018.

CPDP internal Security Management Framework (public version)

CPDP internal Information Security Policy (public version)