Data sovereignty and what Australian businesses must do when data goes offshore

Where your business data lives matters more than it used to. Host a customer database in an overseas cloud region, run your email through a global SaaS provider, or let a support contractor in another country log in to your systems, and more than one country's laws can claim an interest in that information. That is the idea behind data sovereignty: digital information is governed by the laws of the country where it is stored.

In Australia the practical legal work sits in the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) in Schedule 1 of that Act. If you send personal information outside Australia, APP 8 obliges you to take reasonable steps to ensure the overseas recipient handles it consistently with the APPs, and the duties in APP 1 (transparency), APP 11 (security) and the Notifiable Data Breaches scheme decide how you prepare and what you must do when something goes wrong. This guide sets out who those obligations capture, what each duty requires, what non-compliance costs, and the practical steps that keep a small or medium business on the right side of the regulator.

Who has to comply: the APP entity test

The APPs apply to "APP entities", which are agencies and organisations. For a business, the starting point is whether it is an organisation under the Act. Most trading entities are, but there is one significant carve-out: a small business operator, broadly a business whose annual turnover was $3 million or less in the previous financial year, is generally not an organisation and so falls outside the Privacy Act's main rules.

The exemption does not protect everyone who is small. Under s 6D of the Act, a business is not a small business operator if it:

Provides health services and holds health information (other than in an employee record).
Trades in personal information, meaning it discloses personal information about another person for a benefit, service or advantage.
Collects personal information from others in exchange for a benefit, service or advantage.
Is a contracted service provider under a Commonwealth contract.
Is a credit reporting body.
Is related to a larger body corporate that carries on a business that is not a small business.

A business that tips over the $3 million threshold for a financial year also loses the exemption for good, not just for that year. The small business exemption has been the subject of proposed reform for years, so if you sit near the threshold or rely on the exemption, confirm the current position rather than assuming it will hold.

Two further points before the duties. First, the exemption only matters for the Privacy Act. Customers, app stores, payment providers and enterprise clients increasingly expect strong privacy practices regardless of your turnover. Second, some parts of the Act reach further than the main rules, for example the credit reporting provisions, so the picture depends on what your business does, not just how much it earns.

APP 1: say plainly what happens to data offshore

APP 1 requires open and transparent management of personal information. Its most concrete demand is a clearly expressed and up-to-date privacy policy, and that policy must state whether your business is likely to disclose personal information to overseas recipients and, where it is practicable to do so, the countries those recipients are likely to be located in.

This sounds administrative, but it is where many businesses trip up. A privacy policy that promises "we do not send your data overseas" while your CRM vendor backs up to a Singapore or US region is a liability, not a protection. The policy needs to match the actual movement of data through your vendors, backup systems and support arrangements, and it needs to be re-checked whenever you change providers or they change infrastructure.

APP 8: the core duty on cross-border disclosure

APP 8 is the obligation that gives data sovereignty its teeth for Australian businesses. Before disclosing personal information to a person who is not in Australia or an external territory, you must take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the APPs (other than APP 1) in relation to that information.

The first practical question is what counts as a disclosure. The Privacy Act's language is broad, and the regulator's guidance reflects that. Giving an overseas contractor or support team access to systems that hold personal information is a disclosure to them, and so is storing data with a cloud provider whose data centre is outside Australia, including backup and disaster recovery regions. You do not need to hand over a file for a disclosure to occur; allowing someone offshore to view or handle the information is enough.

What are "reasonable steps in the circumstances"? There is no fixed formula. The steps the OAIC and the courts expect tend to include:

Due diligence on the recipient's privacy and security practices before you engage them.
Contractual protections requiring the recipient to handle personal information consistently with the APPs, maintain adequate security, restrict sub-processing, and notify you promptly of breaches or regulator requests.
Ongoing oversight of the arrangement, including knowing who your provider's sub-processors are and where they operate.

A critical consequence sits in s 16C of the Act: where APP 8.1 applies and the overseas recipient does something that would breach the APPs, the recipient's act is taken to be your act, and a breach of the APPs by your business. You cannot outsource compliance. If your provider mishandles the data, the regulator comes after you.

APP 8.1 does not apply in a defined set of situations, and it is worth knowing exactly what they are because the common assumption about consent is wrong. The exceptions include:

Substantially similar protection: you reasonably believe the recipient is subject to a law or binding scheme that protects the information in a way that is, overall, at least substantially similar to the APPs, and that individuals can access mechanisms to enforce that protection. This is why transfers to countries with robust privacy regimes are often defensible, but the belief must be reasonable and supportable, not assumed.
Informed consent: the individual is expressly informed that if they consent to the disclosure, APP 8.1 will not apply to it, and they then consent. Note what this requires: you must tell the person that the usual protection is being disapplied. A general consent in your terms and conditions does not do the job.
Required or authorised by an Australian law or a court or tribunal order.
A permitted general situation, for example where disclosure is reasonably necessary to lessen or prevent a serious threat to the life, health or safety of any individual.
A prescribed country or binding scheme, if the regulations prescribe one as providing substantially similar protection.

The practical takeaway is that consent is an exception, not a default compliance strategy. For routine disclosures to SaaS vendors, overseas support staff and cloud providers, the reasonable steps pathway, meaning due diligence and contracts, is the one that applies day to day.

APP 11: secure the information, wherever it sits

APP 11 requires an APP entity to take such steps as are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. The principle explicitly says those steps include technical and organisational measures.

For a business sending data offshore, APP 11 and APP 8 pull in the same direction. Encryption in transit and at rest, access controls limited to staff who genuinely need the data, multi-factor authentication for remote and offshore access, and vendor management all support the "reasonable steps" analysis under both principles. Expectations are higher where sensitive information is involved, for example health information or government identifiers, and where offshore access raises the risk profile. Documenting what you have done, in an information security policy or similar, is what turns good practice into evidence you can show the OAIC if it ever asks.

The Notifiable Data Breaches scheme: what to report and when

The Notifiable Data Breaches (NDB) scheme in Part IIIC of the Act is what makes a data sovereignty failure visible. An "eligible data breach" occurs where there is unauthorised access to, or unauthorised disclosure of, personal information, or the information is lost in circumstances where that is likely to occur, and a reasonable person would conclude the access or disclosure would be likely to result in serious harm to any affected individual.

That test matters because it changed as part of the 2024 reforms to the Act. The scheme now asks whether a reasonable person would conclude that serious harm is likely, an objective formulation, rather than simply whether serious harm is likely in the entity's own assessment. It is still a serious-harm threshold, so not every incident is reportable, but the assessment has to be made properly.

If you become aware there are reasonable grounds to suspect an eligible data breach, the Act requires you to carry out a reasonable and expeditious assessment and to take all reasonable steps to complete it within 30 days. If the assessment confirms an eligible data breach, you must prepare a statement and, as soon as practicable, notify affected individuals (or, if that is not practicable, publish the statement on your website and take reasonable steps to publicise it), and provide the statement to the OAIC.

Offshore arrangements make this harder in predictable ways. A breach at an overseas vendor may surface during your provider's business hours in another time zone, the vendor's notification obligations may run to a foreign regulator first, and the individuals affected may include people in other countries. Your incident response plan needs to cover who at the vendor you call, what information you need from them, and how you will meet the 30-day assessment window when the evidence sits in another jurisdiction.

The cost of getting it wrong

The headline figure under s 13G of the Act is severe: a body corporate that seriously or repeatedly interferes with an individual's privacy faces a maximum civil penalty of the greatest of $50 million, three times the value of any benefit obtained from the conduct, or 30% of the body corporate's adjusted turnover during the breach turnover period. For a person who is not a body corporate, the maximum is $2.5 million.

Those figures sit on top of the ordinary consequences of a privacy failure. The OAIC can investigate complaints, accept enforceable undertakings, make determinations that can include compensation orders, and take enforcement proceedings in the courts. An eligible data breach must be notified to the OAIC and affected individuals, which means the failure becomes public. For a business that supplies government or enterprise clients, a public breach combined with a documented failure to take reasonable steps can end contracts and future tenders, regardless of the penalty outcome.

A practical compliance checklist

You do not need to rebuild your technology stack to manage data sovereignty risk. The actions that move the dial are:

Map your data flows: List every system that holds personal information, including CRM, email, payments, HR, marketing, storage and backups, and ask each vendor where data is stored and processed, including backup and support environments, and whether any of their staff access your data from outside Australia. Get the answers in writing.
Prefer Australian regions where feasible: Most major cloud providers offer an Australian region. Selecting it simplifies your risk profile for sensitive data. Where onshore storage is not available, document why and what compensating controls you rely on.
Make your privacy policy accurate: Update it to state, in line with APP 1, whether you disclose personal information overseas and, where practicable, the countries involved, and keep it consistent with what your vendors actually do.
Put APP 8 into your contracts: Supplier agreements should commit the provider to handling personal information consistently with the APPs, maintaining adequate security, restricting sub-processing without your approval, and notifying you promptly of breaches or regulator requests. A dedicated data processing agreement can carry the detail.
Secure the information: Implement access controls, encryption, multi-factor authentication for remote access, and vendor management, and document it all in an information security policy that supports APP 11.
Prepare for incidents: A tested data breach response plan, with internal reporting channels, a contact list that includes overseas vendors, and a process for the serious harm assessment and the 30-day window, is what lets you meet NDB timeframes under pressure.
Review annually: Vendors change regions, add sub-processors and change security settings. Re-check your register of overseas disclosures every year and on contract renewal.

When a privacy lawyer earns their fee

A privacy lawyer is usually worth engaging before a problem exists, and the typical engagements are specific. They can confirm whether the Privacy Act captures you at all, including the small business exemption and the exceptions that defeat it. They can pressure-test the "substantially similar" analysis for a particular country or provider, since that exception turns on a reasonable belief you may have to defend. They can draft or review the APP 8 contract architecture, the data processing agreement, and the privacy policy so the documents match the actual flow of data. And when a breach happens, they can run the serious harm assessment, manage the notification steps and deadlines, and deal with the OAIC, which is exactly when mistakes get expensive.

Start this week: map where your data actually goes

The obligation that most Australian businesses miss is not the one they think about. It is the quiet one. Most APP 8 failures do not start with a deliberate offshore transfer. They start with a vendor that stores backups overseas, a support team that logs in from another country, or a marketing tool that syncs data to a parent company offshore, and those are all cross-border disclosures even though no one made a conscious decision to send data anywhere.

So the first action is simple and this week's job: pick your five most important systems that hold personal information, ask each vendor where your data is stored and processed, including backups and support access, and write down the answers. That map is the foundation for every other obligation in this article, and it is the piece most businesses discover they never had.