INTERNATIONAL
TRANSFERS
Comparable protection
Transferring data overseas requires ensuring recipient privacy protections. Under APP 8, the Australian entity remains accountable even after the data leaves — including for support, telemetry, and metadata flows most teams don't realise exist.
WHAT APP 8 REQUIRES
Comparable protection (APP 8.1)
Before disclosing personal information overseas, an entity must take reasonable steps to ensure the overseas recipient handles it consistently with the Australian Privacy Principles.
Accountability sticks at home
Even after disclosure, the disclosing Australian entity remains accountable. If the overseas recipient mishandles the data, the OAIC can pursue the original entity.
Limited exceptions
APP 8.2 lists narrow exceptions (informed consent, recipient subject to substantially similar law, certain enforcement-related disclosures). Most cloud transfers don't qualify.
Hyperscaler default position
Most hyperscaler 'Australia regions' include support, telemetry, and metadata flows that cross borders by default. Reading the data-flow diagram matters more than reading the region label.
HOW WE KEEP YOU ONSHORE
Map cross-border flows
We trace every data flow — primary, backup, telemetry, support access, log shipment, AI/ML training. Many organisations are surprised by what crosses the border quietly.
Onshore where it matters
Personal information, regulated workloads, and sensitive customer data move to sovereign Australian infrastructure. No support staff with foreign access, no offshore log replication.
Documented exceptions
Where a cross-border flow is genuinely required (e.g. global SaaS), we document the APP 8 basis — informed consent, comparable protection assessment, or qualifying exception.
Vendor due diligence
Standardised assessment of overseas vendors against APP 8 — recipient jurisdiction, applicable law, contractual protections, audit rights. Evidence the OAIC will accept.
RELATED REGULATIONS
Privacy Act 1988
Australian privacy principles require reasonable steps to protect personal information.
72-hour notificationNotifiable Data Breaches
Mandatory reporting of breaches likely to result in serious harm.
Risk profileOverseas Data Risks
Foreign jurisdiction, latency, vendor lock-in, and compliance gaps.
KNOW WHERE YOUR DATA GOES?
We map cross-border flows and surface what's exposed under APP 8.