OAIC, APP Guidelines chapter 8: a cross-border disclosure must also satisfy APP 6.1, and the sender stays accountable (Office of the Australian Information Commissioner, Australian Privacy Principles Guidelines, Chapter 8, key points and para 8.4 (version 1.3, 3 October 2025))
Sending data to the US is two tests: APP 6 (is the disclosure allowed at all) and APP 8 (is the buyer bound to handle it properly). Passing APP 8 does not cure a failed APP 6.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“An APP entity that discloses personal information to an overseas recipient is accountable for any acts or practices of the overseas recipient in relation to the information that would breach the APPs (s 16C). ... When an APP entity discloses personal information to an overseas recipient it will also need to comply with APP 6.1. That is, it must only disclose the personal information for the primary purpose for which it was collected unless the individual has consented to the disclosure or an exception to that principle applies”
Where it was read
Also read from the same source
- OAIC, APP Guidelines chapter 8, paragraph 8.16: an enforceable contract is generally expected (Office of the Australian Information Commissioner, Australian Privacy Principles Guidelines, Chapter 8, para 8.16 (version 1.3, 3 October 2025))
- OAIC, APP Guidelines chapter 8, paragraphs 8.20 and 8.21: the substantially similar law exception needs a reasonable basis (Office of the Australian Information Commissioner, Australian Privacy Principles Guidelines, Chapter 8, paras 8.20 to 8.21 (APP 8.2(a)) (version 1.3, 3 October 2025))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide