Cross-border data sharing under APP 8 and what your business must do

Most Australian businesses now run on global tools. Your customer database may sit on servers in Singapore, your support team may log in from the Philippines, and your marketing analytics may be processed in the United States. Every time personal information moves to any of those places, a specific rule kicks in: Australian Privacy Principle (APP) 8 of the Privacy Act 1988 (Cth).

APP 8 is the cross-border disclosure principle. Before you send personal information to anyone outside Australia, it requires you to take reasonable steps to ensure that recipient handles the information to the standards of the Australian Privacy Principles. And if the recipient mishandles it, the Act treats the breach as yours, not theirs. This article sets out who the obligation applies to, the duties it creates, the exceptions you can rely on, and what happens if you get it wrong.

Who APP 8 applies to and what triggers it

APP 8 binds APP entities: Australian Government agencies and the private sector organisations covered by the Privacy Act. For most trading businesses, coverage turns on turnover. An organisation is covered once its annual turnover exceeds $3 million, measured over the previous financial year, under s 6D of the Privacy Act 1988 (Cth). Businesses at or below that figure are generally treated as small business operators and exempt, unless they fall into a category that is covered regardless of size, such as health service providers and credit reporting bodies.

The trigger itself is narrower than many business owners assume. Under APP 8.1, the principle applies when you disclose personal information about an individual to a person who is not in Australia or an external Territory, and who is not you or the individual. In practice that means treating any of the following as a cross-border disclosure:

Cloud hosting: your data is stored on servers outside Australia, or overseas administrators can access it.
SaaS tools: a global platform you subscribe to processes personal information overseas, even if you never think about where it runs.
Offshore teams: support, back-office or development staff outside Australia can log into your CRM, helpdesk or file systems.
Intra-group transfers: you share data with an overseas parent, subsidiary or affiliate, which still counts as a disclosure to a third party.
Payment and analytics providers: an overseas gateway, analytics tool or email platform receives personal information or identifiers.

A useful rule of thumb: if an overseas person or system can access the personal information, treat it as a disclosure and assess it under APP 8. You can sort out later whether an exception applies; the starting point is that the duty is engaged.

Take reasonable steps before you disclose

APP 8.1 requires you to take such steps as are reasonable in the circumstances to ensure the overseas recipient does not breach the Australian Privacy Principles in relation to the information. "Reasonable in the circumstances" is a deliberately flexible standard. It scales with what you are sending, to whom, and how risky the destination is. Sending a marketing list to a well-regulated processor in a country with strong privacy law demands less than handing customer records to an unknown contractor in a jurisdiction with none.

In practice, Australian businesses typically satisfy the duty by combining four measures:

Due diligence: check the recipient's privacy posture, security certifications, incident history and whether it uses sub-processors, and document what you find.
An enforceable contract: a data processing agreement or data protection schedule that requires the recipient to handle the information only for your purposes, keep it secure, cooperate on breaches, flow obligations down to sub-processors and help you respond to individuals exercising their rights.
Security controls: access limits, encryption, logging and monitoring that match the sensitivity and volume of the information.
Redress channels: a realistic way for individuals to complain or enforce their rights against the recipient, such as a recognised regulator or a binding dispute mechanism in your contract.

The standard is not perfection. It is a defensible, documented assessment that you did what was reasonable before the information left the country. Keep the evidence: your assessments, contracts and decisions are what you will point to if the OAIC comes knocking.

Answer for what happens overseas

This is the feature of APP 8 that surprises most business owners: you cannot offshore the liability. Section 16C of the Privacy Act 1988 (Cth) provides that if an overseas recipient does an act that would breach the Australian Privacy Principles, that act is taken to have been done by you and to be a breach of the Principles by you.

So if your overseas provider loses a laptop containing your customers' data, or sells the data it was holding for you, the breach is attributed to your business. The same logic flows into the breach notification scheme. Section 26WC deems personal information held by an overseas recipient to be held by you for the purposes of the Notifiable Data Breaches scheme, meaning a breach at their end is a breach you must assess and, if it meets the threshold, report.

This is why the contract is not a compliance extra. It is your back-to-back protection: it converts your APP 8 obligations into obligations your recipient must meet, and it gives you evidence of reasonable steps. But it does not move legal responsibility away from you. The accountability stays with your business.

Rely on the exceptions only on their own terms

APP 8.2 sets out the circumstances in which the reasonable steps duty does not apply. There are three that matter for most businesses:

Reasonable belief in substantially similar protection: The duty does not apply if you reasonably believe the recipient is subject to a law or binding scheme that protects the information in a way that is, overall, at least substantially similar to the Australian Privacy Principles, and that the individual has mechanisms they can access to enforce that protection. The belief must be genuinely held and defensible. Receiving personal information in the EU, where the General Data Protection Regulation applies, is a common example of a destination where this argument can be made. The bar is high: you need evidence about the recipient's actual obligations, not a general impression that a country has "some privacy law".
Informed consent: The duty does not apply if you expressly inform the individual that, if they consent to the disclosure, APP 8 will not apply, and they then consent. Note the two parts. The warning must be given, and the consent must be real. A general line buried in your terms saying you "may share data with overseas providers" does not satisfy it. The individual must be told that the APP 8 protections will not follow the information, and must consent with that understanding. Consent can also be withdrawn, which makes it a fragile foundation for core services your business cannot run without.
Required or authorised by law: The duty does not apply where the disclosure is required or authorised by or under an Australian law or a court or tribunal order.

The trap here is treating the exceptions as broad. They are narrow and fact-specific. If you plan to rely on one, document how you satisfy each element, and have a lawyer check your reasoning before you build a business process on it. For most businesses, the more durable path is to do the reasonable steps work: diligence, contracts and security, rather than trying to fit every flow into an exception.

Be transparent about overseas disclosure

APP 8 does not operate in isolation. Two other principles require you to tell people what you are doing with their information, including across borders.

APP 1 requires you to maintain a clearly expressed and up-to-date privacy policy. If you disclose personal information overseas, your policy should say so: the kinds of information you disclose, the countries involved or how an individual can find the current list, and why the transfer happens. APP 5 requires a collection notice at or before the time you collect personal information, which should cover the same ground in relation to overseas disclosure.

Keeping these documents accurate matters. A privacy policy that describes data flows your business no longer has, or omits a tool you adopted last quarter, is a compliance problem of its own. The documents should reflect how the business actually operates, and should be reviewed whenever you change providers or expand into new regions.

Secure the information and be ready for a breach

APP 11 requires you to take such steps as are reasonable in the circumstances to protect the personal information you hold from misuse, interference and loss, and from unauthorised access, modification or disclosure. For cross-border flows, that means security measures proportionate to what you are sharing: access controls limited to staff who genuinely need the data, encryption in transit and at rest, logging of who accessed what, and ongoing monitoring of your vendors.

The Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth) then tells you what to do when something goes wrong. An eligible data breach arises where there is unauthorised access to or disclosure of personal information, or loss of it in circumstances where that is likely, and a reasonable person would conclude the access or disclosure would be likely to result in serious harm to affected individuals. If you suspect a breach but are not sure, you must carry out a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 days. If you have reasonable grounds to believe an eligible data breach has occurred, you must notify the OAIC and affected individuals.

Because of the deemed holding rule in s 26WC, a breach at your overseas recipient's end is assessed against your business in the same way as a breach of your own systems. Your contract should require the recipient to tell you promptly about incidents, and your incident plan should say who does what and how you will meet the notification timeline.

What happens if you get it wrong

The penalty regime for privacy breaches was substantially strengthened in 2022. Under s 13G of the Privacy Act 1988 (Cth), a serious interference with privacy can attract a civil penalty for a body corporate of up to the greatest of $50 million, three times the value of the benefit obtained from the conduct, or 30% of the body corporate's adjusted turnover during the breach period. For individuals and other entities, the cap is $2.5 million. Less serious interferences carry penalties of up to 2,000 penalty units.

Beyond court-imposed penalties, the OAIC can make determinations, accept enforceable undertakings and issue infringement notices for certain breaches. Failure to meet Notifiable Data Breaches obligations is itself a civil penalty provision. And for an SME, the reputational cost of a data breach at an overseas provider that is publicly attributed to you can outweigh any fine. Because s 16C attributes the overseas recipient's conduct to your business, the exposure is yours even when the failure happened on the other side of the world.

A working checklist for cross-border compliance

Work through these steps whenever you introduce a new overseas flow, and revisit them when your tooling or providers change:

Map where personal information actually goes, including sub-processors and the countries where data is stored or processed.
Classify each flow: is it a disclosure to an overseas recipient under APP 8?
Run due diligence on each recipient and document the outcome.
Put an enforceable data processing agreement in place for every recipient that handles personal information on your behalf.
Check whether an exception applies to each flow, and document the reasoning if you rely on one.
Update your privacy policy and collection notices to reflect overseas disclosure.
Apply security measures proportionate to the sensitivity and volume of the data.
Build a breach response plan that covers incidents at overseas vendors and the 30-day assessment timeline.
Review the whole picture annually, and whenever you change tools, regions or providers.
Keep records: assessments, contracts, consent language and vendor evidence.

When a privacy lawyer should step in

A privacy lawyer's role in cross-border work is to make the assessment defensible before a problem arises. A practitioner can review and negotiate data processing agreements so they genuinely back-to-back your APP 8 obligations, assess whether a substantially similar argument can be made for a particular destination and recipient, and draft consent language that meets the express notice requirement of APP 8.2. They can also run a transfer impact assessment, audit your vendor onboarding so APP 8 checks become routine, and, when a breach happens at an overseas provider, help you work through the 30-day assessment and notification decisions under pressure.

The point at which you most need that help is before you sign a contract with a new overseas provider, not after a breach. An hour of review at onboarding is far cheaper than defending a determination or a civil penalty proceeding later.

Start with a map of where your data actually goes

The duty most businesses miss is not the initial assessment. It is the ongoing one. The reasonable steps obligation is judged at the time of each disclosure, and your flows change constantly: a new marketing tool, a support contractor who starts working from overseas, a cloud provider that adds a sub-processor in another country. Each of those changes is a fresh APP 8 moment.

So the first action this week is to write the list: every tool, vendor and team that can access personal information, and where the data is stored or processed, including sub-processors. From that list, everything else follows, the contracts to review, the notices to update, the security to check. And as you build it, remember the rule that makes this whole area unforgiving: an overseas recipient's breach is your breach, so the assessment you do now is the difference between a defensible position and a penalty attributed to your business.