Data Privacy and Cybersecurity

Data Privacy and Cybersecurity was prepared by a drafting group convened by the Advisory Board and opened for public consultation before adoption. Every material comment received during the consultation window was logged, considered and disposed of on the record. The version and status shown at the top of this page reflect the outcome of that process; earlier versions, where they exist, remain accessible through the changelog.

A standard is not a checklist. It is a statement of what the Association considers professional practice, expressed in language a member can operationalise, an operator can rely on and a client can read. The requirements above are drafted in the imperative for that reason: they describe conduct, not paperwork.

Members accept the Code of Professional Conduct on joining and, by extension, agree to operate consistently with the standards framework of which this document forms part. Where this standard requires evidence, members are expected to retain that evidence in a form that can be produced on request during periodic review.

Where a jurisdiction imposes an obligation that goes beyond this standard, the jurisdictional rule prevails. Where a jurisdiction is silent, this standard describes the Association's expectation. Where the two conflict, members are expected to comply with law and to record the tension in a note that can be shared during the next consultation cycle.

Most members will operationalise this standard by adjusting three artefacts: the client-facing engagement or quotation document, the internal verification or operating checklist, and the post-engagement record. Reviewing those three documents against the requirements above is a reliable first pass. Where the standard names an evidence expectation, the record should show not only that the step was completed but how it was completed and by whom.

For contested or borderline cases, the Association issues non-binding interpretive notes on request. Notes are anonymised before publication and are treated as reference material for the next scheduled review of this standard.

No standard operates alone. Conduct, disclosure, verification, contracts, payments, safety, privacy, marketing and training are interdependent: a shortfall in one standard often manifests as a failure recorded against another. Members implementing this document are encouraged to read the related knowledge articles linked above and to review the full framework index to place these requirements in context.

Comments, dissenting views and proposed revisions to this standard are welcomed at any time and considered formally at the next scheduled review. The open consultations page lists all drafts currently open for structured feedback.