Overview
A Protective Data Security Plan (PDSP) is a formal, risk-based information security plan required under the Victorian Protective Data Security Framework (VPDSF) and administered by the Office of the Victorian Information Commissioner (OVIC). The PDSP documents how a Victorian Public Sector (VPS) organisation protects public sector information, manages information security risks, and complies with the Victorian Protective Data Security Standards (VPDSS). It is developed following a Security Risk Profile Assessment (SRPA) and outlines the organisation’s current security posture, identified risks, implemented controls, risk treatment activities, third-party assurance measures, and planned security improvements. The plan must address governance, personnel, ICT, physical, and information security controls, including obligations relating to contracted service providers that handle government data on the organisation’s behalf. VPS organisations are also expected to regularly review and update the PDSP, particularly when significant operational, technological, legislative, or risk-related changes occur, and submit the plan to OVIC as part of ongoing compliance and assurance obligations.