Protect Victorian public sector data and ensure compliance with VPDSF/VPDSS

VPDSF/VPDSS compliance is a mandatory requirement for Victorian Public Sector (VPS) organisations to manage and protect public sector data under Part 4 of the Privacy and Data Protection Act 2014 (Vic). 

Adherence to the VPDSF and VPDSS is mandatory for all  organisations within the scope of Parts 4 and 5 of the Privacy and Data Protection Act 2014 (Vic) (PDP Act), and includes all:  

• Victorian public sector agencies and bodies
• Class B cemetery trust stakeholders
• Committee of Management of Crown Land Reserves stakeholders.

The Framework generally excludes councils, universities, ambulance services, public hospitals, public health services and multipurpose services under the Health Services Act 1988 (Vic). While Section 84 (2) provides exemptions from Part 4 of the PDP Act, these exemptions need to be applied with care. If exempt entities perform a public function on behalf of a regulated VPS organisation, they may have obligations under the Part 4 of the PDP Act. 

Some examples on the key standards or primary sources are listed below: 

• Victorian Protective Data Security Framework (VPDSF) V2.1
• Victorian Protective Data Security Standards V2.0 Implementation Guidance Version 2.4
• Victorian Government Risk Management Framework (VGRMF)
• Victorian Government Information Management Framework
• Victorian Government Cyber Security Incident Management Plan
• Protective Security Policy Framework (PSPF) Release 2025
• AS/NZS ISO/IEC 27002:2022
• Australian Government Information Security Manual (ISM) December 2025
• ASD Essential Eight
• IM-GUIDE-06 Victorian Government Information Management Governance Guidelines
• OVIC Practitioner Guide: Identifying and Managing Information Assets V2.0
• OVIC Practitioner Guide: Assessing the security value of public sector information V2.0
• OVIC Information Security Incident Notification Scheme V3.0
• OVIC Practitioner Guide: Information Security Risk Management V2.0
• OVIC Guide to developing an Information Security Incident Management Framework (ISIMF) V2.0 

A typical gap assessment will take 4-6 weeks, depending on the size and complexity of the organisation. Timelines for remediation and implementation services are bespoke the client.

• Develop an Information Asset Register
• Conduct an annual Security Risk Profile Assessment
• Develop documentation and implement controls and processes 
• Prepare PDSP and report to OVIC (biennial), with annual attestation by the Public Sector Body Head. PDSPs must also be submitted within agreed timeframes if there is a significant change to the operating environment or security risks.   

• We can assist in the development of an Information Asset Register.
• We can help develop and conduct an SRPA.
• We can assist in the development of process or information security controls documentation e.g., policies, standards.
• We can assist with the development and external/independent verification of the PDSP (Protective Data Security Plan).   

• *Information Asset Register
• Security Risk Profile Assessment (SRPA)
• Process and controls documentation across the 12 VPDSS Standards. Note that documentation is also dependent upon the maturity level of the organisation.
• Protective Data Security Plan (PDSP)   

 *An Information Asset Register is not technically required under legislation, however it is an artefact under Standard 2 of the VPDSS. Note that for organisations to perform an SRPA, it is typically required to have a good understanding of the information assets, the risks or threats those assets are exposed to, and the existing/implemented controls that protect those assets.  

Adherence to the VPDSF and VPDSS is mandatory for all organisations within the scope of Parts 4 and 5 of the Privacy and Data Protection Act 2014 (Vic) (PDP Act), and includes all:  

• Victorian public sector agencies and bodies
• Class B cemetery trust stakeholders
• Committee of Management of Crown Land Reserves stakeholders. 

 The Framework generally excludes councils, universities, ambulance services, public hospitals, public health services and multipurpose services under the Health Services Act 1988 (Vic). While Section 84 (2) provides exemptions from Part 4 of the PDP Act, these exemptions need to be applied with care. If exempt entities perform a public function on behalf of a regulated VPS organisation, they may have obligations under the Part 4 of the PDP Act. 

An organisation must complete an attestation by the Public Sector Head annually and complete a PDSP every two years.  

 In consultation with OVIC, VPS organisations must also submit an updated PDSP within agreed timeframes if there is a significant change to the VPS organisation’s operating environment, or the security risks relevant to the VPS organisation.