Victorian Protective Data Security Framework (VPDSF) compliance software
Assess and evidence the Victorian Protective Data Security Standards, from governance through ICT security, ready for OVIC attestation.
What AU VPDSF requires
The Victorian Protective Data Security Framework, administered by the Office of the Victorian Information Commissioner under Part 4 of the Privacy and Data Protection Act 2014 (Vic), sets the data security obligations for Victorian public sector organisations.
The framework's standards span security governance, information security, personnel security, ICT security and physical security, supported by the five-step protective data security cycle: identify information assets, assess their value, apply protections, manage risks and mature capability.
Agencies submit a Protective Data Security Plan (PDSP) to OVIC on a two-year cycle with an executive attestation — which makes maintained, evidenced assessment far more defensible than a point-in-time scramble.
Who it applies to
- Victorian government departments and agencies
- Bodies established for a public purpose under Victorian law
- Contracted service providers handling Victorian public sector data
- Local entities aligning to OVIC expectations by agreement
At a glance
- Regulator: Office of the Victorian Information Commissioner (OVIC)
- Legal basis: Privacy and Data Protection Act 2014 (Vic), Part 4
- Standards: Governance, information, personnel, ICT and physical security
- Reporting: PDSP submission and attestation on a two-year cycle
How GRCLens supports AU VPDSF
AU VPDSF runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Standard-by-standard assessment
VPDSF elements pre-loaded with guidance and deliverables, assessed with status, owners and evidence.
PDSP-ready record
Maintained assessments provide the evidence base behind the Protective Data Security Plan and executive attestation.
ISM alignment
ICT security standards reference Australian ISM controls, and evidence is shared with the IRAP module where applicable.
Information asset context
Attach information asset registers and business impact ratings — the framework's starting point — to the relevant standards.
AU VPDSF frequently asked questions
Who must comply with the VPDSF?
Victorian public sector bodies subject to Part 4 of the Privacy and Data Protection Act 2014, and service providers handling their data where contracts require it.
What is a PDSP?
The Protective Data Security Plan is the agency's reporting instrument to OVIC, submitted on a two-year cycle with attestation. GRCLens maintains the requirement-level evidence that underpins it.
How does the VPDSF relate to the Australian ISM?
The VPDSF's ICT security standard draws on ISM controls. GRCLens links the two so technical evidence is captured once.
Does GRCLens submit the PDSP for us?
No. Submission remains with the agency; the platform provides the maintained assessment and artefacts behind it.
One platform, many obligations
Talk to us about AU VPDSF
Security Solution Consultants provides Victorian public sector security advisory alongside the platform, so you can combine tooling with hands-on expertise.
Contact us