13Setting principle—reasonable security standards

13 Setting principle—reasonable security standards

(1) As part of satisfying itself that a project is consistent with the setting principle set out in subsection 16(5) of the Act, including the element set out in paragraph 16(6)(b) of the Act, an entity must take into account the matters set out in this section. (2) To be a reasonable security standard, a security standard must be proportionate to both of the following, as assessed by the entity: (a) the sensitivity of the data; (b) the risks posed by sharing, collecting or using the data. (3) The application of reasonable security standards may, in some cases, mean that accredited entities that are not Commonwealth bodies must comply with Commonwealth security standards, or parts of them.