APPI

The 22 domains APPI groups its controls into

Where APPI overlaps with the standards you already hold

What APPI means in your sector

What APPI means for your job

Questions people ask about APPI

Query APPI programmatically

APPI, its 21 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.

What APPI requires, control by control

Each page carries the requirement text for one APPI control and what an assessor expects to see as evidence.

• ARTICLE-17 Specification of the Purpose of Use
• ARTICLE-18 Restriction on Handling Beyond the Purpose of Use
• ARTICLE-19 Prohibition of Improper Use
• ARTICLE-20 Proper Acquisition and Special Care Required Personal Information
• ARTICLE-21 Notice or Public Announcement of the Purpose of Use
• ARTICLE-22 Accuracy and Deletion of Personal Data
• ARTICLE-23 Security Control Measures
• ARTICLE-24 Supervision of Employees
• ARTICLE-25 Supervision of Trustees
• ARTICLE-26 Report of Leakage to the Commission and Notification to the Person

How much of another standard APPI already covers

Each crosswalk is judged control by control, and the mappings that were rejected are kept alongside the ones that held.

• APEC Cross-Border Privacy Rules (CBPR) System to APPI crosswalk
• Australia My Health Records Act 2012 to APPI crosswalk
• CCPA/CPRA to APPI crosswalk
• Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 to APPI crosswalk
• APPI to GDPR crosswalk
• APPI to ISO 27701:2019 crosswalk
• APPI to NIST SP 800-53 Rev 5 crosswalk
• APPI to SOC 2 crosswalk