VPDSF Protective Markings for Local Government

Enable seamless VPDSF protective markings across Microsoft 365.

Understanding the VPDSF

The Victorian Protective Data Security Framework (VPDSF) sets out how public sector organisations must protect sensitive information. Victorian Local Government Authorities (LGAs) that manages a Class B cemetery trust or a Committee of Management are required to comply.

At its core the VPDSF is about ensuring classified information is handled with care, whether it is stored, shared or created. One of the key obligations is to use protective markings such as OFFICIAL: Sensitive to identify sensitivity in documents and emails. Learn more from the Office of the Victorian Information Commissioner (OVIC).

Where we come in

Most Victorian LGAs already use Microsoft 365 but have not configured it to support protective markings. That's where we help.

We work with you to configure Microsoft 365 so staff can classify information consistently and correctly, while giving compliance teams the tools they need to monitor and manage it.

Our solution is:

  • Aligned with the VPDSF protective marking requirements
  • Built around E3 licence capabilities so you get maximum compliance without expensive upgrades or additional software purchases
  • Delivered in practical stages to minimise disruption and maximise adoption
  • Tailored to manage exceptions with legacy systems and automated processes that generate documents and send emails

Is this for you?

You need to comply with VPDSF obligations but protective markings feels complex and hard to enforce

Legacy systems and automated processes make consistent labelling a challenge

You want to ensure sensitive information is labelled correctly without disrupting day-to-day operations

You want to avoid costly licence upgrades while still giving compliance teams the tools they need


If that sounds familiar, this solution is designed for you. We understand the real-world pressures faced by local government; tight budgets, stretched teams and growing compliance expectations. Our approach meets you where you are and makes protective marking part of everyday work.

What we do

Configure and align

We set up protective labels, policies and data loss prevention rules in Microsoft Purview for Outloook, Word, Excel, and PowerPoint. Staff operate on E3 licences to view and apply labels, while compliance officers on E5 licenses can centrally monitor, report and manage. If you choose, we also deploy our optional E5 package to enable automated labelling at rest and in transit across your entire user base (E5 licenses required).

Roll out and refine

We deliver a phased rollout that starts with optional classification and moves to mandatory application, rolled out department by department. As part of this process, we also identify systems and automated processes that may require exception handling. In parallel, we define sensitive information types so users receive label recommendations based on content, helping them apply the correct classification with greater confidence.

Train and empower

We provide targeted training for end users and compliance teams, supported by simple quick-reference guides. Staff learn how to apply labels with confidence, while administrators are trained to use Purview tools to monitor usage, report on trends and respond to potential incidents.

What you get

For Staff

  • Protective marking built directly into Microsoft 365 apps, including Outlook, Word, Excel and PowerPoint across desktop, web and mobile
  • Label suggestions based on document content, helping staff choose the correct classification with ease
  • Clear, practical training sessions supported by quick-reference guides

For Risk and Compliance Officers

  • Central monitoring, reporting and oversight through Microsoft Purview
  • Access to classification audit trails and labelling usage metrics
  • Hands-on training to manage policies, investigate incidents and support compliance reviews

For Project Leads and IT Teams

  • A phased rollout plan that minimises disruption and supports department-by-department adoption
  • Discovery workshops to identify exceptions, such as legacy systems or automated processes, and plan for appropriate handling
  • Ongoing support and guidance as your compliance needs evolve or as OVIC updates its requirements

Why choose Bitesize Digital?

We combine deep experience in local and federal government, specifically in the protective marking space, with a practical step-by-step approach designed and proven for Victorian LGAs. Our team understands the technical landscape and complexity councils face and works alongside you to embed protective markings smoothly into your existing workflows.

We know most councils operate on E3 licences so we've optimised our solution to give you maximum compliance without needing to upgrade everyone to a higher license. When you're ready, our optional upgrade package includes even more value by including automated content labelling (both in-transit and at rest) to get the most out of your E5 licenses, and further meet VPDSF compliance.

Contact us to learn more and book a demo.

Frequently Asked Questions

Do staff need E5 licences to apply labels?

No. E3 licences are sufficient for label application. E5 is only needed for central monitoring and management by compliance staff.

How seamless is it for users?

Microsoft Purview is built into existing M365 apps. No additional plugins, toolbars, or add-ons are required. Labels appear as dropdowns or prompts during natural workflows.

What about systems or automated processes that generate content?

During the discovery phase, we work with you to identify any systems, templates or service accounts that generate documents or emails but can't apply labels directly. These may include legacy systems, or automated workflows. We work with you to define how each case should be handled. For example, applying a default label through policy, excluding certain service accounts, or planning to update templates over time. This ensures protection without breaking existing processes, while also building a clear path toward long-term compliance.

Can the system suggest labels automatically?

Yes. We configure Purview to detect sensitive information types (e.g. personal data, health identifiers) and suggest the appropriate label to users.

Ready to simplify VPDSF compliance?

Book your free intro call and demo to find out how Victorian councils can rollout protective marking capability and meet their VPDSF obligations.

Contact us

Contact Us

Digital transformation, one bite at a time.

Address

Ballarat, Victoria, Australia