Offshore Teams andPrivacy: AU/NZ Guide

Yes, in most cases. Australian and New Zealand businesses can share customer information with an offshore team in the Philippines if they take the protection steps the law requires first. In Australia that duty sits mainly in APP 8 (OAIC). In New Zealand it sits in IPP 12, with a separate agent rule under Privacy Act 2020 section 11 (OPC).

This guide is general information, not legal advice. If you handle sensitive information such as health records, talk to a privacy adviser before you start. For service options and how Telex sets up access, see https://www.telexph.com/services and https://www.telexph.com/about/compliance-security.

First, check whether the Privacy Act covers you. According to the Office of the Australian Information Commissioner (OAIC), most small businesses with an annual turnover of $3 million or less are not covered. Some are covered regardless of turnover, including health service providers and businesses that trade in personal information (OAIC, Small business: https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/small-business). The OAIC recommends protecting personal information as best practice even if you are exempt.

If you are covered, APP 8 applies before you disclose personal information to an overseas recipient (OAIC APP guidelines Chapter 8: https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-8-app-8-cross-border-disclosure-of-personal-information):

- Giving customer details to an overseas contractor is, in most cases, a "disclosure", so APP 8 applies.

- You must take reasonable steps so the overseas recipient does not breach the APPs. The OAIC generally expects an enforceable contract covering the types of information shared, the purpose, storage and destruction, complaint handling, and a data breach response plan.

- Under section 16C you can stay accountable for what the overseas recipient does with that information, even after you have taken reasonable steps.

- Exceptions include where the individual consents after being expressly told that APP 8 will not apply.

In practice: a written agreement, a clear list of what data the offshore team can see, and a way to check that the rules are followed.

IPP 12 was a new principle in the Privacy Act 2020. It sets rules for disclosing personal information to a foreign person or entity (OPC Principle 12: https://www.privacy.org.nz/privacy-act-2020/privacy-principles/12/).

Before you apply IPP 12, check whether there is a "disclosure" at all. Under section 11 of the Privacy Act 2020, if you send personal information to an overseas organisation that holds or processes it solely as your agent, and that organisation does not use or disclose the information for its own purposes, the transfer is not treated as a use or disclosure by you — so IPP 12 does not apply. You remain responsible for ensuring the agent handles the information in accordance with the Privacy Act (legislation.govt.nz, s 11: https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23318.html; OPC Principle 12 Decision Tree: https://www.privacy.org.nz/responsibilities/disclosing-personal-information-outside-new-zealand/decision-tree-page/). OPC guidance often cites cloud storage and similar processing arrangements as examples; if the overseas party uses the information for its own purposes, it is also treated as holding it and IPP 12 can apply.

When IPP 12 does apply, OPC explains you may only disclose if you check that the receiving organisation:

- is subject to the Privacy Act because it does business in New Zealand, or

- will adequately protect the information (for example with model contract clauses), or

- is subject to privacy laws that provide comparable safeguards.

If none of those apply, you can only disclose with the person's permission after expressly telling them their information may not get the same protection as under New Zealand law.

For many NZ businesses working with an offshore support team, the practical path is either a true agency arrangement under section 11 (with clear limits so the provider does not use the data for its own purposes) or, where IPP 12 applies, a written agreement with comparable safeguards. Do not assume the agent exception covers every BPO set-up — check the facts of your contract.

Before you sign, ask:

- Which systems will your team use, and will they log in to our tools or copy data into theirs?

- Who can see our customer data, and how is access removed when someone leaves?

- Will privacy obligations, including breach notification, sit in the contract?

- Do you use subcontractors, and are they bound by the same terms?

- What happens to our data when the contract ends?

- For NZ clients: will you act only as our agent under Privacy Act s 11, or will IPP 12 comparable-safeguard clauses apply?

The Philippines has the Data Privacy Act of 2012 (Republic Act 10173). Section 20 requires personal information controllers to put reasonable organisational, physical and technical security measures in place, and section 14 says a processor must comply with the Act (National Privacy Commission: https://privacy.gov.ph/data-privacy-act/). That does not replace your APP 8 or IPP 12 duties.

How Telex handles access in practice: our network is protected by live-tested Fortinet firewall policies with failover configured; Group Policy restricts command-line tools to administrators; Microsoft Azure AD logs are part of our security controls; new internal systems go through security testing before rollout; staff take GDPR assessments; agents use only their own active accounts; and Audit & Compliance runs scheduled audits. Your team keeps the decisions and approvals that need to stay in your business. Ask how data access would be set up for your account before you sign: https://www.telexph.com/contact. More on our security posture: https://www.telexph.com/about/compliance-security.