Comparison
GDPR vs CPS 234
GDPR · APRA CPS 234 Information Security · data 2026-10-27
Requirement-level comparison of GDPR and APRA CPS 234 Information Security, in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 24 APRA CPS 234 Information Security requirements, 23 map to something in GDPR, 0 are only loosely related, and 1 have no mapping in our data.
CPS 234 is principles-based: it requires controls commensurate with threats without naming them, so most technical topics show no link. APRA's guide CPG 234 names specific practices but is not binding and not mapped. All links are editorial.
Likely new work: CPS 234 requirements with no mapping to GDPR (1)
| CPS 234 | Requirement | Match | GDPR | Evidence |
|---|---|---|---|---|
| Testing control effectiveness · 1 | ||||
| Para 29 | Escalate deficiencies that can't be fixed quickly | No mapping in our data | — | No mapping to GDPR in our data. |
Mapped (23)
| CPS 234 | Requirement | Match | GDPR | Evidence |
|---|---|---|---|---|
| Roles and responsibilities · 2 | ||||
| Para 13 | Board ultimately responsible for information security | Editorial | Art.24(1)Art.32(2)Art.37(1)+1 | Same topic: Risk Management, Roles & Responsibilities (editorial pick) |
| Para 14 | Define information security roles and responsibilities | Editorial | Art.37(1)Art.39(1) | Same topic: Roles & Responsibilities (editorial pick) |
| Information security capability · 3 | ||||
| Para 15 | Maintain a capability commensurate with threats | Editorial | Art.24(1)Art.32(2) | Same topic: Risk Management (editorial pick) |
| Para 16 | Assess third parties' information security capability | Editorial | Art.28(1)Art.28(3) | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| Para 17 | Keep capability current as threats and vulnerabilities change | Editorial | Art.32(1)(d)Art.35(1)Art.35(7) | Same topic: Vulnerability Mgmt, Risk Assessment (editorial pick) |
| Policy framework · 2 | ||||
| Para 18 | Maintain an information security policy framework | Editorial | Art.24(2) | Same topic: Governance Policy (editorial pick) |
| Para 19 | Policies direct everyone with security obligations | Editorial | Art.24(2) | Same topic: Governance Policy (editorial pick) |
| Information asset identification and classification · 1 | ||||
| Para 20 | Classify information assets by criticality and sensitivity | Editorial | Art.30(1) | Same topic: Asset Management (editorial pick) |
| Implementation of controls · 2 | ||||
| Para 21 | Timely controls commensurate with risk and asset life-cycle | Editorial | Art.5(1)(e)Art.5(1)(f)Art.32(1)(b)+2 | Same topic: Data Protection (editorial pick) |
| Para 22 | Evaluate the design of third parties' controls | Editorial | Art.28(1)Art.28(3) | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| Incident management · 4 | ||||
| Para 23 | Detect and respond to incidents in a timely manner | Editorial | Art.33(1)Art.33(5) | Same topic: Incident Response (editorial pick) |
| Para 24 | Maintain information security response plans | Editorial | Art.33(1)Art.33(5) | Same topic: Incident Response (editorial pick) |
| Para 25 | Response plans cover all stages and escalation | Editorial | Art.33(1)Art.33(5) | Same topic: Incident Response (editorial pick) |
| Para 26 | Review and test response plans annually | Editorial | Art.33(1)Art.33(5) | Same topic: Incident Response (editorial pick) |
| Testing control effectiveness · 4 | ||||
| Para 27 | Systematic testing programme for control effectiveness | Editorial | Art.24(1)Art.32(1)(d)Art.32(2) | Same topic: Risk Management, Vulnerability Mgmt (editorial pick) |
| Para 28 | Check third parties' control testing is adequate | Editorial | Art.28(1)Art.28(3) | Same topic: Vendor Risk Mgmt (editorial pick) |
| Para 30 | Testing by skilled, functionally independent specialists | Editorial | Art.32(1)(d) | Same topic: Vulnerability Mgmt (editorial pick) |
| Para 31 | Review the testing programme at least annually | Editorial | Art.24(1)Art.32(2) | Same topic: Risk Management (editorial pick) |
| Internal audit · 3 | ||||
| Para 32 | Internal audit reviews control design and effectiveness | Editorial | Art.5(2) | Same topic: Compliance (editorial pick) |
| Para 33 | Assurance provided by appropriately skilled personnel | Editorial | Art.5(2) | Same topic: Compliance (editorial pick) |
| Para 34 | Internal audit assesses third-party assurance relied on | Editorial | Art.5(2)Art.28(1)Art.28(3) | Same topic: Compliance, Vendor Risk Mgmt (editorial pick) |
| APRA notification · 2 | ||||
| Para 35 | Notify APRA of material incidents within 72 hours | Editorial | Art.33(1)Art.34(1) | Same topic: Reporting (editorial pick) |
| Para 36 | Notify APRA of material control weaknesses within 10 business days | Editorial | Art.33(1)Art.34(1) | Same topic: Reporting (editorial pick) |
Of 13 GDPR requirements, 10 map to something in CPS 234, 0 are only loosely related, and 3 have no mapping in our data.
GDPR is a privacy law: only its security-related articles are mapped here, and all mappings are editorial.
Likely new work: GDPR requirements with no mapping to CPS 234 (3)
| GDPR | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| Requirements · 3 | ||||
| Art.25 | Data protection by design and by default | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Art.29 | Processing under the authority of the controller or processor | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Art.38 | Position of the data protection officer | No mapping in our data | — | No mapping to CPS 234 in our data. |
Mapped (10)
| GDPR | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| Requirements · 10 | ||||
| Art.5 | Principles relating to processing of personal data | Editorial | Para 21Para 32Para 33+1 | Same topic: Data Protection, Compliance (editorial pick) |
| Art.24 | Responsibility of the controller | Editorial | Para 13Para 15Para 27+3 | Same topic: Risk Management (editorial pick) |
| Art.28 | Processor | Editorial | Para 16Para 22Para 28+1 | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| Art.30 | Records of processing activities | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| Art.32 | Security of processing | Editorial | Para 17Para 27Para 30+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.33 | Notification of a personal data breach to the supervisory authority | Editorial | Para 23Para 24Para 25+3 | Same topic: Incident Response (editorial pick) |
| Art.34 | Communication of a personal data breach to the data subject | Editorial | Para 35Para 36 | Same topic: Reporting (editorial pick) |
| Art.35 | Data protection impact assessment | Editorial | Para 17Para 21 | Same topic: Risk Assessment (editorial pick) |
| Art.37 | Designation of the data protection officer | Editorial | Para 13Para 14 | Same topic: Roles & Responsibilities (editorial pick) |
| Art.39 | Tasks of the data protection officer | Editorial | Para 13Para 14 | Same topic: Roles & Responsibilities (editorial pick) |
By topic
Both cover (12):
Governance PolicyRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceAsset ManagementRisk AssessmentVulnerability MgmtData ProtectionIncident ResponseReportingVendor Risk Mgmt
Only GDPR (11):
Awareness & TrainingAccess ControlEncryptionBackup & RecoverySecure DevelopmentCloud SecurityRecovery PlanningBusiness ContinuityComms & RestoreDisaster RecoveryInsider Threat
Only CPS 234 (5):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.