Allied Health NDIS Audit Checklist: worksheet
Privacy Act: the Australian Privacy Principles and notifiable data breaches. Edition held: Privacy Act 1988 (Cth), Compilation No. 104 (C2026C00227), in force 4 June 2026, registered 17 June 2026 (Schedule 1, the Australian Privacy Principles; Part IIIC, notifiable data breaches); checked current on 6 October 2026 (Federal Register of Legislation Versions API: the latest and current compilation on 6 October 2026).
Under review, not in force: From 10 December 2026, APP 1.7 to 1.9 add automated-decision content to the privacy policy (Privacy and Other Legislation Amendment Act 2024, Schedule 1 items 87 and 88). Not in force yet.
Standards library: https://compliance.theartofservice.com/frameworks/australian-privacy-principles-apps. Page: https://allied-health-ndis-audit-checklist.theartofservice.com/rules/privacy-act/app-8-cross-border-disclosure/
Applies when: APP 8 applies only to a disclosure to an overseas recipient. On the profile it is not applicable until the practice answers yes or not sure. The question: Is any client information disclosed to a person or service outside Australia (for example overseas practice software support, transcription or cloud storage)?
| Ref | Requirement (our statement of the clause) | Evidence an auditor or the regulator asks for | Common gap to check | Held (yes, partly, no, not applicable) | Where it is kept | Owner | Last reviewed | Next review |
|---|---|---|---|---|---|---|---|---|
| APP 8.1 | Before disclosing personal information to an overseas recipient (not the practice itself or the person), take reasonable steps so that the recipient does not breach the APPs (other than APP 1), usually through a contract. Source: https://www.legislation.gov.au/C2004A03712/latest/text | A list of overseas recipients and the contract terms that bind each to APP-equivalent handling | Overseas support access to the practice system not identified as a disclosure | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| APP 8.2(a), (b) | The duty does not apply where the practice reasonably believes the recipient is bound by a law or binding scheme at least substantially similar to the APPs with mechanisms the person can use, or where the person consents after being expressly told APP 8.1 will not apply. Source: https://www.legislation.gov.au/C2004A03712/latest/text | The assessment of the overseas law or scheme relied on, or the consent wording used | Consent obtained without telling the person APP 8.1 will not apply | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| APP 8.2(c), (d) | It also does not apply where the disclosure is required or authorised by an Australian law or court order, or a permitted general situation applies (other than items 4 and 5 of s 16A(1)). Source: https://www.legislation.gov.au/C2004A03712/latest/text | A note of the law or situation relied on for any such disclosure | No record of the basis | ☐ yes ☐ partly ☐ no ☐ n/a |
Completing this worksheet records what your practice holds and where. It does not make a practice compliant or ready for audit, and it is not legal advice.