Chapter 11 - Australian Privacy Principle 8 - Cross-border disclosure of personal information (sections 19 and 20)

Sep 18, 2026

Chapter 11 explains Australian Privacy Principle 8 (APP 8) and how it prevents entities from avoiding privacy obligations when personal information is disclosed to recipients outside Australia. It describes the extraterritorial operation of the Privacy Act under sections 19 and 20, the meaning of “disclosure” versus “transfer,” and how routing via overseas servers may not constitute disclosure. It also sets out accountability for overseas recipient acts, applicable exceptions, and the “reasonable steps” duty to ensure equivalent APP protections.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages33

Reading Time1 h 23 min

AccessFree to download

Introduction

Australian Privacy Principle 8 (APP 8)

Disclosure vs transfer and routing through overseas servers

Extension to agencies and key exceptions

Reasonable steps and contractual arrangements

Sections 19 and 20: extraterritorial operation and accountability

Background

Cross-border data flows and privacy concerns

International frameworks and harmonisation efforts

Chapter 11 Australian Privacy Principle 8–cross-border disclosure of personal information and sections 19 and 20 Introduction 11.1 Australian Privacy Principle 8 (APP 8) outlines measures to ensure that entities cannot avoid obligations to protect personal information by disclosing the information to a recipient outside Australia. 1 Section 19 provides for the extraterritorial operation of the new Privacy Act.2 Section 20 provides that an entity remains accountable for the acts and practices of overseas recipients to which it discloses personal information.3 11.2 The Companion Guide notes that APP 8 uses the term 'disclosure', rather than'transfer', which was used in National Privacy Principle 9 (NPP 9) as 'transfer' implies that there is a cross-border movement of personal information rather than the accessing of personal information by an overseas recipient, regardless of whether the information is stored in Australia or elsewhere through 'disclosure'. The Companion Guide notes that the routing of personal information through servers which are located outside of Australia is not intended to constitute a disclosure.4 11.3 APP 8 has been extended to apply to agencies as well as organisations.5 In addition, APP 8 provides conditions for the disclosure of personal information outside Australia to ensure that entities remain accountable for any disclosures they make, rather than prohibiting cross-border disclosures all together as is the case under NPP 9. However, a series of exceptions provide for an entity not to be held accountable for the disclosure of personal information to an overseas recipient.6 11.4 The principle provides that before disclosing any personal information outside of Australia, an entity has to take 'reasonable steps' to ensure that the overseas recipient will not breach the APPs, by making sure that personal information has sufficient protection. The Companion Guide notes it is expected that the obligations of the overseas recipient would be set out in a contract to establish effective information 7 management arrangements. 1 Australian Government, Companion Guide, Australian Privacy Principles, June 2010, p. 12. 2 Australian Government, Companion Guide, Australian Privacy Principles, June 2010, pp 6–7. 3 Australian Government, Companion Guide, Australian Privacy Principles, June 2010, p. 13. 4 Australian Government, Companion Guide, Australian Privacy Principles, June 2010, p. 12. 5 Australian Government, Companion Guide, Australian Privacy Principles, June 2010, p. 12. 6 Australian Government, Companion Guide, Australian Privacy Principles, June 2010, p. 12. 7 Australian Government, Companion Guide, Australian Privacy Principles, June 2010, p. 12. 11.5 Section 19 provides for the extraterritorial operation of the Act. In addition, unlike the Privacy Act 1988 (Privacy Act) which only extended to the acts or practices undertaken by an organisation outside of Australia in relation to the personal information of Australian citizens or permanent residents, the new Privacy Act will extend to protect every person, operating in relation to acts done or practices engaged in outside of Australia, by agencies and organisations with an Australian link.8 The definition of an 'Australian link' is similar to that provided under subsection 5B(2) of the current Privacy Act.9 11.6 The Companion Guide also states that arrangements under the existing Privacy Act which ensure that an act or practice that is done or engaged in outside Australia is not an interference with privacy if the act or practice is required by an applicable law of a foreign country, will be replicated in the new Privacy Act. These provisions will extend to cover agencies as well as organisations. 10 11.7 Under proposed section 20, an entity is held accountable for the acts and practices of overseas recipients. 11 The Companion Guide notes that while the term'accountability' is not used in this section, the provisions

FAQs

What is the purpose of APP 8 in relation to cross-border disclosures?

APP 8 ensures entities cannot avoid privacy obligations by disclosing personal information to recipients outside Australia. It does this by requiring measures that keep the entity accountable under the APP framework.

How do APP 8 and the earlier NPP 9 differ in terminology?

APP 8 uses “disclosure” rather than “transfer.” “Transfer” in NPP 9 implies a cross-border movement of information, whereas “disclosure” focuses on accessing by an overseas recipient regardless of where the data is stored.

What duties must an entity take before disclosing personal information outside Australia?

Before disclosure, the entity must take “reasonable steps” to ensure the overseas recipient will not breach the APPs by ensuring sufficient protection of the personal information. The Companion Guide expects these obligations to be established effectively, such as through contractual arrangements.

Sep 18, 2026

Uploaded by Riley West