Privacy Act 1988, Schedule 1, APP 8.1 and 8.2(b): disclosure to an overseas recipient (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), Sch 1, APP 8.1, 8.2(b))
Before sending personal information to a US buyer the holder must take reasonable steps to make the buyer handle it as the APPs require. The alternative is to tell the individual expressly that APP 8.1 will not apply and obtain consent, which takes the disclosure outside APP 8.1.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“Before an APP entity discloses personal information about an individual to a person (the overseas recipient): (a) who is not in Australia or an external Territory; and (b) who is not the entity or the individual; the entity must take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the Australian Privacy Principles (other than Australian Privacy Principle 1) in relation to the information. ... (b) both of the following apply: (i) the entity expressly informs the individual that if he or she consents to the disclosure of the information, subclause 8.1 will not apply to the disclosure; (ii) after being so informed, the individual consents to the disclosure;”
Where it was read
Also read from the same source
- Privacy Act 1988, Schedule 1, APP 6.1 and 6.2(a): use or disclosure for a secondary purpose (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), Sch 1, APP 6.1, 6.2(a))
- Privacy Act 1988, Schedule 1, APP 8.3: disclosure to a prescribed country or binding scheme (in force from 11 December 2024) (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), Sch 1, APP 8.3)
- Privacy Act 1988, section 16C: the holder is accountable for the overseas recipient's breaches (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), s. 16C(2))
- Privacy Act 1988, section 100(1A): what the Minister must be satisfied of before prescribing a country (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), s. 100(1A))
- Privacy Act 1988, section 6(1): definition of de-identified (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), s. 6(1) (definition of de-identified))
- Privacy Act 1988, section 6D: a small business that discloses personal information for a benefit loses the exemption (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), s. 6D(1), (4)(c), (7))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides