Hiring a software development company in Australia: Privacy Act and APP 8

If an Australian company gives personal information to a software vendor overseas, APP 8 and section 16C of the Privacy Act 1988 make the Australian company accountable for what the vendor does with it. You must take reasonable steps to make sure the vendor handles the data in line with the Australian Privacy Principles, and a contract is the normal way to do that.

Does the Privacy Act apply to your business?

The Privacy Act 1988 binds Australian Government agencies and most private organizations with annual turnover above A$3 million. Smaller businesses are exempt unless an exception applies, such as being a health service provider, trading in personal information, or providing services under a Commonwealth contract. The OAIC explains the test in its small business guidance, and the Act itself is on legislation.gov.au.

If you are inside the Act, you are an "APP entity" and the 13 Australian Privacy Principles apply to you, including the one that governs overseas vendors.

What does APP 8 require when a vendor is overseas?

APP 8.1 says that before you disclose personal information to an overseas recipient, you must take reasonable steps to make sure that recipient does not breach the APPs in relation to that information. Section 16C then goes further. If the overseas recipient does something that would breach the APPs, you are treated as having done it yourself. The OAIC's APP 8 guidelines set out the detail.

There are exceptions in APP 8.2, for example where the recipient is bound by a law substantially similar to the APPs and the individual can enforce it, or where the individual consents after being told that APP 8.1 will not apply. In practice, most software buyers rely on the contract route.

A useful point from the OAIC guidance is that a disclosure happens when you make personal information accessible to others outside your organisation and release it from your effective control. Keeping data in a Sydney cloud region does not by itself settle the question if an overseas team can reach it, so check the facts with your counsel.

What should the contract with the vendor say?

Write the APPs into the contract. At minimum, cover these items.

1. Purpose limitation. The vendor may use personal information only to deliver your project.
2. Security. Named measures that satisfy APP 11, such as encryption, access control and logging.
3. Sub-processors. A list, with your prior approval for changes.
4. Breach notice. A fixed number of hours from the vendor's discovery to your notification.
5. Return or deletion. Defined steps and a certificate at the end.
6. Audit evidence. Security documentation on request, and cooperation with an OAIC inquiry.

For a deeper view of data terms, see IP and data terms for AI projects.

How does the Notifiable Data Breaches scheme work?

Part IIIC of the Privacy Act requires you to notify the OAIC and affected individuals when an eligible data breach is likely to cause serious harm. If you only suspect a breach, you must carry out a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 days of becoming aware (section 26WH). The OAIC describes the process in its guide to the Notifiable Data Breaches scheme.

Your 30 days start from when you become aware of reasonable grounds to suspect a breach. If a vendor sits on an incident for two weeks, that time is already gone. This is why the vendor's notice period belongs in the contract.

What is new for AI and automated decisions in 2026?

The Privacy and Other Legislation Amendment Act 2024 added a transparency duty on automated decision-making. From 10 December 2026, an APP entity that uses personal information in a computer program to make, or substantially help make, a decision that could significantly affect someone's rights or interests must say so in its privacy policy. The policy must describe the kinds of personal information used and the kinds of decisions made. The OAIC published resources on this obligation on 30 September 2026.

If you are commissioning an AI feature that approves, ranks, prices or screens people, tell your vendor now so the design can log how decisions are made. That also helps with evals before production. The same Act also created a statutory tort for serious invasions of privacy, which commenced on 10 June 2025.

How much time overlap will you get with an India-based team?

Australia has three standard time zones and daylight saving in some states. Sydney, Melbourne and Canberra use AEST (UTC+10), moving to AEDT (UTC+11) from the first Sunday in October to the first Sunday in April. Queensland does not change clocks. Perth is on AWST (UTC+8). India is UTC+5:30 all year.

Assume the India team works 08:00 to 17:00 IST and the Australian team works 09:00 to 17:00 local.

The east coast needs an early start in India to get a decent overlap. With a standard 10:00 to 19:00 IST day, Sydney in summer would share only about 1.5 hours. Plan the work around written briefs and a short daily overlap call. Working across time zones covers the habits that make that work.

Frequently asked questions

A short close

Australian rules put the responsibility on you and let you share it through contract and design. Pick a partner who will agree to the clauses above without a long fight.

Want this built for your team? Book a free 30-minute call.