APAC / Asia-Pacific / revised 28 Oct 2026
Australia APP 8 and s.16C: Cross-Border AI Inference
APP 8 does not stop Australian personal information leaving Australia. It requires an entity that discloses personal information to an overseas recipient to take reasonable steps to ensure the recipient does not breach the APPs, and section 16C makes the Australian entity accountable for the overseas recipient's acts. For AI inference, the provider's conduct becomes your liability.
- Citation
- Privacy Act 1988 (Cth), Schedule 1, Australian Privacy Principle 8, and section 16C
- Regulator
- Office of the Australian Information Commissioner (OAIC)
- In force
- 12 March 2014 (APPs); penalty increase from 13 December 2022; Privacy and Other Legislation Amendment Act 2024 assented 10 December 2024
- Maximum penalty
- For serious interference with privacy by a body corporate, the greater of AUD 50 million, three times the benefit obtained, or 30% of adjusted turnover for the relevant period (s. 13G)
APP 8.1 and the s.16C accountability rule
Before an APP entity discloses personal information to an overseas recipient, APP 8.1 requires it to take reasonable steps to ensure the recipient does not breach the APPs (other than APP 1) in relation to that information. Section 16C then provides that an act or practice of the overseas recipient that would breach the APPs is taken to be an act or practice of the Australian entity. In practice the reasonable steps are an enforceable contract plus due diligence on the recipient's controls.
APP 8.2 lists exceptions, including where the entity reasonably believes the recipient is subject to a law or binding scheme substantially similar to the APPs that individuals can enforce, and where the individual consents after being expressly told that APP 8.1 will not apply.
Use or disclosure: the cloud question
APP 8 is triggered by a disclosure. OAIC guidance explains that providing personal information to an overseas cloud provider can be a use rather than a disclosure where the entity keeps effective control of the information and the provider handles it only for the limited purpose of the service under binding obligations. A model provider that retains prompts, uses them for its own purposes or trains on them is much harder to fit within that reasoning.
The 2022 and 2024 amendments
The Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 raised the maximum penalty for serious or repeated interferences with privacy to the greater of AUD 50 million, three times the benefit, or 30% of adjusted turnover. The Privacy and Other Legislation Amendment Act 2024 added a mechanism to prescribe countries and binding schemes as substantially similar for APP 8.2(a), tiered civil penalties and infringement notices, a statutory tort for serious invasions of privacy, and new privacy policy disclosures about automated decisions that significantly affect individuals, which apply from 10 December 2026.
- 01
Keep effective control over prompts
Contractual zero retention, no training on customer data, and deletion on completion support the argument that sending a prompt to an offshore model is a use under the entity's control rather than a disclosure. - 02
Australian endpoints for sensitive information
Health information, tax file numbers and government identifiers carry extra rules. Route these to inference in Australian regions or a self-hosted runtime and skip the APP 8 analysis for those flows. - 03
Identifier masking
Detect and tokenise tax file numbers, Medicare numbers and driver licence numbers in-path. TFNs are also governed by the Privacy (Tax File Number) Rule 2015, which limits their use and disclosure. - 04
Automated decision records
From 10 December 2026, privacy policies must describe the kinds of personal information used in substantially automated decisions. Tag requests that feed such decisions so the policy description matches the actual data flows. - 05
Breach scoping
The Notifiable Data Breaches scheme applies to information held by an overseas recipient if the entity remains accountable. Per-request records of the processing region make the assessment faster.
| # | Rule | Legal rationale |
|---|---|---|
| 01 | Requests from Australian tenants marked sensitive resolve to Australian endpoints only. | Removes APP 8 and s.16C exposure for the data most likely to cause serious harm in a breach. |
| 02 | Non-sensitive Australian traffic may reach offshore models only when the provider has zero retention and a no-training term on file. | These terms are the reasonable steps evidence and support the use-not-disclosure analysis. |
| 03 | Tokenise TFNs and Medicare numbers before any offshore hop. | Minimises the most regulated identifiers and keeps the re-identification vault in Australia. |
| 04 | Label automated-decision requests and record the policy version that routed them. | Supports the 2024 transparency obligation and gives the OAIC a clear answer about what data drove a decision. |
au-app8
The rules above, written as Open Policy Agent Rego (v1 syntax). The gateway evaluates the pack in-process in every regional data plane before forwarding a request; YTT Secunet measures median evaluation under 3 ms in production.
Packs are versioned and signed. The version that decided each request is named in the residency receipt, so an auditor can match the decision to this exact text.
How the policy engine workspackage yttsecunet.policies.au_app8
import rego.v1
default allow := false
au_regions := {"ap-southeast-2", "ap-southeast-4", "australiaeast"}
allow if {
input.request.origin_country == "AU"
input.route.provider_region in au_regions
}
allow if {
input.request.origin_country == "AU"
not input.request.sensitive
input.route.zdr == true
input.route.no_training_term
input.guardrail.tfn_masked
input.guardrail.medicare_masked
}
reasons contains "sensitive AU data must stay onshore" if {
input.request.sensitive
not input.route.provider_region in au_regions
}Each item is verifiable against configuration, signed receipts or contract records. Tick through it with your DPO.
Does Australia require personal data to stay onshore?
Not generally. APP 8 regulates cross-border disclosure through accountability. Specific regimes, such as the My Health Records Act 2012, impose onshore storage for particular data sets.
Is consent a practical way to rely on APP 8.2?
Rarely for AI features. The individual must be expressly told that APP 8.1 will not apply, and that consent must be informed and current. Most entities rely on contracts and reasonable steps instead.
Has the government prescribed any substantially similar countries yet?
The 2024 Act created the power to prescribe them. Check the Privacy Regulations for any countries or schemes listed before relying on APP 8.2(a) on that basis.
Sovereign route ready
Stop risking 4% global turnover GDPR fines on AI inference.
Deploy sovereign, cryptographically proven AI routing in 15 minutes.