Email marketing platforms, accounting software, customer relationship tools, AI assistants and website analytics are often run from servers outside Australia. Every time customer details go into one of them, that data may be going overseas.
What APP 8 says
Australian Privacy Principle 8 covers disclosing personal information to a recipient overseas. Before you do it, a covered business must take reasonable steps to make sure the recipient does not breach the Australian Privacy Principles in relation to that information. In many cases the business can still be held accountable for what the overseas recipient does with it.
What "reasonable steps" often looks like
- Choose providers that publish a clear privacy and security commitment
- Use a written agreement or the provider's data processing terms
- Check where the data is stored and who can access it
- Limit what you send to what the tool actually needs
Tell people it happens
Your privacy policy should say whether you disclose personal information overseas and, where practical, which countries. A short table of your main providers, what they do and where they are based is an easy way to do this honestly.
Watch the AI tools
Staff pasting customer details into an AI chatbot is a disclosure to an overseas provider in many cases. Decide which tools are approved, and what must never be pasted in.
What to do this week
- List every cloud tool that touches customer information
- Note the country each provider operates from
- Check your privacy policy mentions overseas disclosure
- Write a one-line rule for staff on what may go into AI tools
This is general information, not legal advice. If you are unsure how this applies to your business, speak with a qualified privacy lawyer and see the OAIC guidance.