Who must comply with APP 8 cross-border disclosure?

Before disclosing personal information overseas, APP 8 requires reasonable steps so the recipient meets the APPs — unless an exception applies. Steps and exceptions.

APP 8.1 requires entities to take such steps as are reasonable in the circumstances to ensure overseas recipients do not breach the APPs. Section 16C makes the disclosing entity liable for the overseas recipient's acts in some cases. Exceptions include consent, similar laws, and lawful disclosure for permitted general/health situations.

Applies when the business has APP-entity status (turnover > $3M or a s 6D(4) carve-out) and offshore data or foreign ownership. Where the business has APP-entity status (turnover > $3M or a s 6D(4) carve-out) and international activity, check whether you disclose personal information to overseas recipients (APP 8).

How the regulator frames it: APP entities disclosing personal information overseas (cloud hosting, parent company, vendors).

What triggers it: Sending personal information to an overseas recipient.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (35 of 35: no).

The answer is the same in every industry: no. Industry does not change who must comply.

Structure does not change the answer across all industries: for every structure the answer is "no".

Size does not change the answer across all industries: at every size band the answer is "no".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires APP-entity status (turnover > $3M or a s 6D(4) carve-out) and offshore data or foreign ownership.

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

• The business makes or receives international funds transfers: it becomes worth checking, because it applies only if you disclose personal information to overseas recipients (APP 8).
• The business is foreign-owned: it then applies (annual turnover over $3M — an APP entity under the Privacy Act (s 6D) · Foreign-owned).
• The business stores or discloses personal information offshore: it then applies (annual turnover over $3M — an APP entity under the Privacy Act (s 6D) · Stores or discloses personal information offshore).
• The business sells to international customers: it becomes worth checking, because it applies only if you disclose personal information to overseas recipients (APP 8).

The engine shows this obligation as "check whether this applies" when a business has APP-entity status (turnover > $3M or a s 6D(4) carve-out) and international activity. It then applies only if you disclose personal information to overseas recipients (APP 8). That fact is not something Rules Mate can infer from industry, structure or size.

When due

Continuous.

Frequency

Ongoing

Evidence to keep

Data flow mapping, contractual safeguards (DPA), legal opinion on overseas regime, consent records where relied upon.

Status

Current

Priority

High

Maximum penalty: Same penalty regime as broader Privacy Act breaches.

Self-assessment. Authority: Privacy Act 1988 (Cth) ss6D, 33C, Sch 1 APP 1; OAIC Guide to privacy regulatory action Ch 9.

Frequency: Ongoing. No mandated periodic audit. APP 1 requires an up-to-date privacy policy and reasonable practices and procedures.

Who can perform it: The entity itself. The OAIC may conduct a privacy assessment (s33C) at its discretion and can compel documents; you cannot commission an OAIC assessment as an audit.

• APP 3 collection of sensitive information: APP 3 bars collecting sensitive information — health, race, religion, sexual orientation and more — without consent. What counts as sensitive, the exceptions and penalties.
• Automated decision-making transparency in your privacy policy (APP 1.7–1.9): From 10 December 2026, APP entities that use computer programs to make or substantially assist decisions that significantly affect individuals must say so in their APP privacy policy.
• Notifiable Data Breach (NDB) scheme: Under the NDB scheme, APP entities must notify the OAIC and affected individuals of an eligible data breach likely to cause serious harm — assessed within 30 days.
• APP 12 & APP 13 access and correction requests: Individuals can ask to access (APP 12) and correct (APP 13) the personal information you hold — the strict response times, allowable refusals and how to comply.
• APP 7 direct marketing: consent, opt-out & when you can't message (2026): APP 7 restricts using or disclosing personal information for direct marketing and requires a simple opt-out — when it applies, the exceptions and penalties.

Rules Mate tracks 20 published obligations tagged "privacy", 3 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 4 of those apply outright. This obligation is rated high priority, and is an ongoing duty.

Regulated by Office of the Australian Information Commissioner.

OAIC: Privacy and freedom of information regulator. Administers the Privacy Act 1988, the Notifiable Data Breaches scheme, and the Australian Privacy Principles.

• Office of the Australian Information Commissioner

Privacy Act 1988: Federal privacy Act.

• Privacy Act 1988

Free tools that help with this obligation:

• Privacy Act 2026 readiness
• NDB notification timer
• Marketing compliance check (Spam Act)