APP 8 and offshore vendors: cross-border disclosure, s 16C accountability and the cloud 'use' test

What it is. Australian Privacy Principle 8 covers cross-border disclosure of personal information. Under APP 8.1, before an APP entity discloses personal information to an overseas recipient, it must take reasonable steps to ensure the recipient does not breach the APPs (other than APP 1) in relation to that information. Section 16C adds the accountability rule: if the recipient then does something that would breach the APPs, the act is treated as done by the disclosing entity and as that entity's breach. The OAIC's APP guidelines, Chapter 8, set out how it reads both provisions. This page follows that chapter.

Who counts as an overseas recipient

The OAIC describes an overseas recipient as someone who receives the information and is not in Australia or an external Territory, is not the disclosing entity, and is not the individual the information is about. Sending records to your own overseas office is not an APP 8 disclosure, because the recipient is the same entity. Sending them to a related body corporate overseas is, because a related company is a separate entity. Group structures matter: 'it is just our parent company' does not take a transfer outside APP 8.

Disclosure, use, or a breach

The OAIC treats disclosure as making information accessible outside the entity and releasing its later handling from your effective control. That includes accidental releases, unauthorised releases by an employee, and publishing information online where people overseas can reach it, whether or not that was intended. Two things are not disclosures. Information that only passes through servers outside Australia in transit is usually a 'use'. Information taken by a third party who deliberately gets around your security, for example in a cyber attack or theft, is unauthorised access, not a disclosure by you. The OAIC says that case is dealt with under APP 11 (security of personal information): you may breach APP 11 if you did not take reasonable steps to protect the information.

Offshore contractors and cloud

The OAIC says that giving personal information to an overseas contractor to perform services for you is a disclosure in most cases. Its examples include an outsourced overseas processor for online purchases, an overseas firm doing reference checks on job applicants, and an Australian company that gives its overseas parent access to the customer database for technical and billing support. Offshore helpdesk and support access is therefore in scope, not just bulk data transfers.

There is a narrow route out. Where an overseas cloud provider only stores the information and makes sure you can get at it, the OAIC says this may be a use rather than a disclosure if three things are true: a binding contract limits the provider to those purposes, the contract binds any subcontractors to the same obligations, and the contract leaves you in effective control of how the information is handled. The OAIC lists questions that go to control: whether you can access, change or retrieve the information, who else can reach it and why, what security measures protect it, and whether you can retrieve or permanently delete it when it is no longer needed or the contract ends. If the arrangement is a use, you still 'hold' the information, so APP 11 and the other APPs that apply to held information still bite while it sits with the provider.

What 'reasonable steps' usually looks like

The OAIC generally expects an enforceable contract that requires the recipient to handle the information in line with the APPs (other than APP 1). It suggests the contract cover the types of information and the purpose, APP-compliant collection, use, disclosure, storage and destruction or de-identification, a matching contract with any subcontractor, complaint handling, and a data breach response plan that includes notifying you when there are reasonable grounds to suspect a breach. How far you go, including whether you audit, depends on the sensitivity of the information, whether you have dealt with this recipient before, the likely harm if it is mishandled, the recipient's existing technical and operational safeguards, and practicability, including time and cost. The OAIC says being inconvenient, time-consuming or costly does not on its own excuse you; a step is unreasonable only if the burden is excessive in all the circumstances. Agencies also have s 95B, which requires contractual measures with contracted service providers, including terms that stop subcontracts authorising a breach; the OAIC says s 95B measures will generally satisfy APP 8.1.

The exceptions in APP 8.2

APP 8.1 and s 16C do not apply where an exception does. (a) You reasonably believe the recipient is bound by a law or binding scheme that, overall, protects the information in a way at least substantially similar to the APPs, and that the individual can access mechanisms to enforce it. The OAIC says the belief needs a reasonable basis, which might come from independent legal advice, and you must be able to justify it. A further exception covers countries or binding schemes prescribed by regulations, subject to any conditions. (b) You expressly tell the individual that if they consent, APP 8.1 will not apply, and they then consent. The OAIC says the statement should at least explain that the entity will not be accountable and the individual cannot seek redress under the Privacy Act if the recipient mishandles the information, and that it should be given when consent is sought. (c) The disclosure is required or authorised by an Australian law or a court or tribunal order. A foreign law or order does not count. (d) A permitted general situation under s 16A applies, such as lessening or preventing a serious threat to life, health or safety, or taking appropriate action on suspected unlawful activity or serious misconduct. Further exceptions, including international information-sharing agreements and enforcement-related activities, apply only to agencies.

Accountability under s 16C

The OAIC says s 16C applies when APP 8.1 applied to the disclosure, the APPs do not apply to the recipient, and the recipient does something that would breach the APPs (other than APP 1) if they did. You can be liable even if you took reasonable steps, if the recipient's subcontractor is the one that breaches, and if the recipient's breach was inadvertent. You are not accountable where you relied on an APP 8.2 exception, or where the recipient has an 'Australian link' (s 5B(2)) and is covered by the Privacy Act itself. Under s 6A(4), an act done outside Australia because an applicable foreign law requires it does not breach the APPs, and you are not accountable for it. The OAIC suggests telling individuals in your APP 5 notice or privacy policy where a recipient may be compelled by foreign law to disclose their information.

Practitioner checklist

1. Map every flow of personal information leaving Australia, including support and admin access from overseas staff, parent companies and managed service providers, not just storage regions. 2. For each vendor, record whether you treat the arrangement as a disclosure or a use, and why. If you claim 'use' for offshore cloud, check the contract really delivers the three OAIC conditions and the access, retrieval and deletion rights. 3. Put the OAIC's suggested terms into contracts: purpose limits, APP-level handling, subcontractor flow-down, complaints, and a duty to tell you promptly when a breach is suspected, so your own assessment can start. 4. Scale due diligence and auditing to the sensitivity of the data and the harm if it leaks. Document why the steps were reasonable. 5. If you rely on an exception, keep the evidence: the legal advice behind a 'substantially similar' belief, the exact consent wording, or the Australian law that requires the disclosure. 6. Link the vendor register to your incident runbook. Under s 16C the recipient's breach can be your breach, so the vendor's status page and breach notice belong in the same playbook as your own breach assessment.

Desk note: this page summarises the OAIC's APP guidelines, Chapter 8 (updated 3 October 2025, fetched 26 October 2026). It is not legal advice. The Privacy Act 1988 is the authority.