APP 8: client information that goes overseas
Before disclosing personal information to a recipient outside Australia, a practice takes reasonable steps so that the recipient does not breach the APPs, unless an exception applies, such as a law or binding scheme substantially similar to the APPs with enforcement the person can use, or informed consent after being told the protection will not apply.
Privacy Act APP 8.1, APP 8.2(a), (b), APP 8.2(c), (d)
Office of the Australian Information Commissioner
Privacy Act 1988 (Cth), Compilation No. 104 (C2026C00227), in force 4 June 2026, registered 17 June 2026 (Schedule 1, the Australian Privacy Principles; Part IIIC, notifiable data breaches)
6 October 2026, Federal Register of Legislation Versions API: the latest and current compilation on 6 October 2026
Every allied health practice that provides a health service and holds health information, whatever its turnover (s 6D(4)(b)), every profession, speech pathology included, NDIS registered or not.
Privacy Act: the Australian Privacy Principles and notifiable data breaches on the standards library
From 10 December 2026, APP 1.7 to 1.9 add automated-decision content to the privacy policy (Privacy and Other Legislation Amendment Act 2024, Schedule 1 items 87 and 88). Not in force yet.
APP 8 applies only to a disclosure to an overseas recipient. On the profile it is not applicable until the practice answers yes or not sure. The question: Is any client information disclosed to a person or service outside Australia (for example overseas practice software support, transcription or cloud storage)?
Before disclosing personal information to an overseas recipient (not the practice itself or the person), take reasonable steps so that the recipient does not breach the APPs (other than APP 1), usually through a contract.
- A list of overseas recipients and the contract terms that bind each to APP-equivalent handling
- Overseas support access to the practice system not identified as a disclosure
The duty does not apply where the practice reasonably believes the recipient is bound by a law or binding scheme at least substantially similar to the APPs with mechanisms the person can use, or where the person consents after being expressly told APP 8.1 will not apply.
- The assessment of the overseas law or scheme relied on, or the consent wording used
- Consent obtained without telling the person APP 8.1 will not apply
It also does not apply where the disclosure is required or authorised by an Australian law or court order, or a permitted general situation applies (other than items 4 and 5 of s 16A(1)).
- A note of the law or situation relied on for any such disclosure
- No record of the basis
| Ref | Held (yes, partly, no, not applicable) | Where it is kept | Owner | Last reviewed | Next review |
|---|---|---|---|---|---|
| APP 8.1 | |||||
| APP 8.2(a), (b) | |||||
| APP 8.2(c), (d) |
Completing this worksheet records what your practice holds and where. It does not make a practice compliant or ready for audit, and it is not legal advice.
Related requirements
Privacy Act: the Australian Privacy Principles and notifiable data breaches
- APP 7.1, 7.4 to APP 7.8APP 7: newsletters and marketing to clients
- APP 9.1, APP 9.2APP 9: NDIS numbers, Medicare numbers and other government identifiers
- APP 6.1 to APP 6.5APP 6: sharing client information with other practitioners and the NDIS
- APP 10.1, APP 10.2APP 10: keeping client information accurate and up to date
- APP 5.1 to APP 5.2(g) to (j)APP 5: the collection notice for clients
- APP 11.1, APP 11.3, APP 11.2APP 11: securing client records and destroying them when no longer needed
- APP 4.1, 4.2, APP 4.3, 4.4APP 4: information the practice did not ask for
- APP 12.1, 12.4 to APP 13.3 to 13.5APP 12 and 13: client requests to see or correct their records
- Every page of this instrument
The same topic in other instruments (privacy and records)
- NDIS Practice Standards Core 5.1, Core 5.2, Core 5.3Core module: Privacy and dignity
- NDIS Practice Standards Core 12.1 to Core 12.4Core module: Information management
- NDIS Code of Conduct s 6(1)(b)Respect the privacy of people with disability
- Children guidance P-2Protect privacy and dignity, and ask before touching
- Ahpra shared Code of conduct 3.3Confidentiality and privacy
- Psychology Board Code of conduct 3.3Privacy and confidentiality
See every requirement for your practiceSee the specimen practice