Privacy Act 1988, section 16C: the holder is accountable for the overseas recipient's breaches (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), s. 16C(2))
If the buyer mishandles personal information in a way that would breach the APPs, the Australian holder is treated as having breached them. This is why the contract with the buyer matters.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“The act done, or the practice engaged in, by the overseas recipient is taken, for the purposes of this Act: (a) to have been done, or engaged in, by the APP entity; and (b) to be a breach of those Australian Privacy Principles by the APP entity.”
Where it was read
Also read from the same source
- Privacy Act 1988, Schedule 1, APP 6.1 and 6.2(a): use or disclosure for a secondary purpose (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), Sch 1, APP 6.1, 6.2(a))
- Privacy Act 1988, Schedule 1, APP 8.1 and 8.2(b): disclosure to an overseas recipient (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), Sch 1, APP 8.1, 8.2(b))
- Privacy Act 1988, Schedule 1, APP 8.3: disclosure to a prescribed country or binding scheme (in force from 11 December 2024) (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), Sch 1, APP 8.3)
- Privacy Act 1988, section 100(1A): what the Minister must be satisfied of before prescribing a country (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), s. 100(1A))
- Privacy Act 1988, section 6(1): definition of de-identified (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), s. 6(1) (definition of de-identified))
- Privacy Act 1988, section 6D: a small business that discloses personal information for a benefit loses the exemption (Privacy Act 1988 (Cth), Compilation No. 104 (4 June 2026), s. 6D(1), (4)(c), (7))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides