Data Residency & Privacy Playbook: The Privacy Act Reforms, APPs & NZ Privacy Act

Privacy law is one of the first legal frameworks a foreign technology company encounters when entering the Australian and New Zealand markets — often before the first local customer is signed. Unlike sector-specific licences that can be deferred until a business reaches scale, privacy obligations attach at the point of collecting or holding personal information, which typically happens on day one of any software deployment, marketing campaign, or user registration flow.

Australia and New Zealand have mature, well-enforced privacy regimes. Both are undergoing active reform cycles that are raising obligations and penalties to levels comparable with the GDPR. Understanding the architecture of each regime — and the differences between them — is essential for any product, engineering, legal, or operations team preparing an ANZ launch.

The risks of non-compliance are concrete: Australia's maximum civil penalty for a serious or repeated privacy breach is now A$50 million for a corporate entity (or 3× the benefit obtained, or 30% of adjusted turnover in the relevant period — whichever is greatest), as confirmed by the Australian Attorney-General's Department. That penalty ceiling was introduced in December 2022 following high-profile data breaches and signals that regulators are prepared to use it.

Two separate but structurally similar privacy regimes operate across the ANZ region:

• Australia: The Privacy Act 1988 (Cth), administered by the Office of the Australian Information Commissioner (OAIC), governs all APP entities through 13 Australian Privacy Principles (APPs). It is a federal act that applies nationally.
• New Zealand: The Privacy Act 2020, administered by the Office of the Privacy Commissioner (OPC), governs all agencies through 13 Information Privacy Principles (IPPs). It came into force on 1 December 2020, replacing the 1993 Act.

Both acts are extraterritorial in reach: they apply to foreign companies that carry on business in the respective country or collect personal information from residents there. A company that launches a SaaS product to ANZ customers without a local entity is still subject to both regimes.

The 13 Australian Privacy Principles (APPs) are the core obligations under the Privacy Act 1988. They are grouped into five functional areas:

• Consideration of personal information privacy (APP 1–2): APP 1 requires open and transparent management of personal information, including a clearly expressed and up-to-date privacy policy. APP 2 requires organisations to give individuals the option of not identifying themselves where lawful and practicable.
• Collection of personal information (APP 3–5): APP 3 restricts collection of solicited personal information to what is reasonably necessary; APP 4 covers unsolicited information; APP 5 requires notification of collection purposes at or before the time of collection.
• Dealing with personal information (APP 6–8): APP 6 restricts use or disclosure to the primary purpose of collection (with defined exceptions); APP 7 governs direct marketing; APP 8 covers cross-border disclosure (discussed separately below).
• Integrity of personal information (APP 10–11): APP 10 requires organisations to take reasonable steps to ensure personal information is accurate, up-to-date, and complete; APP 11 requires reasonable security measures against misuse, interference, loss, or unauthorised access.
• Access and correction (APP 12–13): APP 12 gives individuals the right to access their personal information; APP 13 gives them the right to request corrections.

APP 9 governs the adoption, use, or disclosure of government-related identifiers (e.g., Tax File Numbers, Medicare numbers) — an area particularly relevant to HR-tech and health-tech products entering the Australian market.

Under APP 1, every APP entity must have a clearly expressed and up-to-date privacy policy that is freely available (typically online at no charge). The policy must cover at minimum:

• The kinds of personal information the organisation collects and holds;
• How the organisation collects and holds personal information;
• The purposes for which personal information is collected, held, used, and disclosed;
• How an individual may access their information and seek correction;
• How an individual may complain about a breach of the APPs, and how the organisation will handle the complaint;
• Whether the organisation is likely to disclose personal information to overseas recipients, and (if practicable) which countries.

From 10 December 2026, APP 1 will also require disclosure of automated decision-making practices (see the reform section below). Foreign companies should build this requirement into their privacy policy template from the outset to avoid a costly rewrite at the compliance deadline, as analysed by Johnson Winter Slattery.

Yes. The Privacy Act 1988 applies to an organisation that carries on a business in Australia, even if the organisation is incorporated or based overseas and has no registered Australian entity. Carrying on business includes operating a website or app that collects personal information from Australian individuals, running targeted advertising at an Australian audience, and providing cloud software to Australian businesses or consumers.

The OAIC's guidance confirms that the annual turnover threshold of A$3 million applies to private-sector organisations. Organisations with annual turnover at or below this threshold are generally exempt — but this exemption has significant carve-outs. Companies that:

• provide a health service and hold health information;
• trade in personal information (buy or sell it as a commercial activity);
• are contracted service providers under a Commonwealth contract;
• operate as a credit reporting body;

— are all covered by the Act regardless of turnover. Most B2C SaaS and digital platform operators will reach the A$3 million threshold as part of ordinary growth, so the exemption should not be relied upon as a long-term strategy. Tranche 2 reforms (currently under development) propose removing the small-business exemption entirely.

Personal information is defined broadly under the Privacy Act 1988 as information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether recorded in material form or not. This encompasses:

• Names, contact details, dates of birth, and government identifiers;
• IP addresses, device identifiers, and cookies (where linked to or linkable to an individual);
• Health information, financial information, and biometric data (which are also categories of sensitive information attracting heightened obligations under APP 3);
• Inferred or derived data about an individual (e.g., behavioural profiles, credit scores).

For product and engineering teams, the practical implication is that standard web analytics, user authentication systems, CRM records, and support-ticket data almost certainly constitute personal information and must be handled in accordance with the APPs from day one of deployment in Australia.

APP 8 — Cross-Border Disclosure is the principle that most directly affects foreign companies that process Australian personal data outside Australia — including in US-based cloud infrastructure, EU data centres, or offshore engineering and support teams.

Under APP 8.1, before an APP entity discloses personal information to an overseas recipient, it must take reasonable steps to ensure the overseas recipient does not breach the APPs in relation to that information. The OAIC's Chapter 8 Guidelines explain that the standard mechanism is an enforceable contractual arrangement — a data processing agreement (DPA) or similar contract — that requires the overseas recipient to handle the information in a way that is broadly consistent with the APPs.

A critical accountability feature under section 16C of the Privacy Act is that the disclosing Australian entity remains liable for any act or practice of the overseas recipient that would breach the APPs, even if the disclosing entity took reasonable steps. This means that the APP entity cannot simply contract away accountability — it retains ongoing liability for its overseas sub-processors and cloud vendors.

Yes. APP 8.2 provides three exceptions to APP 8.1:

• Exception 1 — Individual consent: The individual has expressly consented to the disclosure after being informed that APP 8.1 will not apply. This is a high bar; consent must be informed, voluntary, current, and specific.
• Exception 2 — Prescribed country or scheme (new from 11 December 2024): The Privacy and Other Legislation Amendment Act 2024, which was passed by Parliament on 29 November 2024, introduced a mechanism for the government to whitelist jurisdictions or binding schemes by regulation. Disclosure to a recipient in a prescribed country, or participating in a prescribed scheme (subject to any conditions), is permitted without satisfying APP 8.1. No countries have been prescribed at the time of writing, but this is the most likely path to a future adequacy-style arrangement with the EU or other GDPR jurisdictions.
• Exception 3 — Required or authorised by law: Disclosure is required or authorised by an Australian law or a court/tribunal order.

Importantly, APP 8 does not apply where personal information is transferred to an overseas office of the same entity (e.g., a US parent company accessing its Australian subsidiary's data for internal purposes). However, where a distinct overseas sub-processor or vendor is used, APP 8 applies in full.

Practical steps for a foreign company managing Australian personal information:

• Map your data flows: Identify all systems and third parties that receive or process Australian personal information, including cloud providers (AWS, Azure, GCP), analytics platforms, CRMs, and support-ticketing tools.
• Execute APP 8-compliant DPAs: For each overseas recipient that is a distinct legal entity, ensure a written agreement requires them to handle Australian personal information consistently with the APPs. Standard GDPR Standard Contractual Clauses (SCCs) provide a useful starting framework but should be reviewed against APP requirements with Australian counsel.
• Update your privacy policy: APP 1 requires disclosure of whether personal information is disclosed overseas and, if practicable, which countries. List all relevant jurisdictions (e.g., United States, Ireland, Singapore).
• Review your sub-processor chain: Under section 16C, your organisation remains accountable for your sub-processors. Include sub-processor obligations in your vendor contracts and periodically audit compliance.
• Consider data residency options: For government and enterprise customers, data residency in Australia (hosting in AWS Sydney, Azure Australia East, or Google Cloud Sydney) is increasingly expected and may be contractually required. This eliminates many APP 8 concerns for that data subset.

The Notifiable Data Breaches (NDB) scheme is contained in Part IIIC of the Privacy Act 1988 and has applied since February 2018. It requires any organisation covered by the Privacy Act to notify both the OAIC and affected individuals when a data breach is likely to result in serious harm to any individual whose personal information is involved.

Under the OAIC's NDB scheme guidance, a notifiable data breach involves three cumulative elements:

1. There is unauthorised access to, unauthorised disclosure of, or loss of personal information held by the entity;
2. The access, disclosure, or loss is likely to result in serious harm to one or more individuals; and
3. The entity has not been able to prevent the likely risk of serious harm through remedial action.

The Privacy Act does not prescribe a fixed number of days for notification. However, 30 days is widely referenced in regulatory practice as a reasonable outer limit. Organisations should conduct a preliminary assessment quickly — within 30 days of becoming aware of a suspected breach — to determine whether it is notifiable. In practice, ASIC and APRA-regulated entities face shorter internal timeframes under their sector-specific obligations, and the 2024 reforms include measures that may introduce formal timeframes in future.

The penalty regime was dramatically strengthened in December 2022 following high-profile data breaches affecting millions of Australians. As confirmed by the Attorney-General's Department, the current maximum civil penalties for a serious or repeated interference with privacy are:

• A$50 million for bodies corporate — or, if greater: 3× the benefit obtained from the conduct, or 30% of the entity's adjusted turnover during the breach turnover period;
• A$2.5 million for individuals.

Secondary sources that cite A$1.8 million or A$360,000 figures are referring to the pre-December 2022 limits and are no longer current.

Following the Privacy and Other Legislation Amendment Act 2024, the OAIC also gained the power to issue infringement notices (penalty notices) for up to 200 penalty units (A$66,000) for certain administrative interferences with privacy, effective from 11 December 2024. (Note: this A$66,000 figure is sourced from FTI Consulting's commercial law analysis of the Act; confirm against primary OAIC or AG sources before relying on it in legal advice.)

The Privacy and Other Legislation Amendment Act 2024 was passed by the Australian Parliament on 29 November 2024 and received Royal Assent on 10 December 2024. As detailed by the Attorney-General's Department, it progresses 23 proposals from the Government's response to the 2022 Privacy Act Review Report. The key Tranche 1 inclusions are:

• Children's Online Privacy Code: A framework for the OAIC to develop and register a Children's Online Privacy Code targeting online services likely to be accessed by children. The specific obligations of the Code are not yet finalised; foreign platforms with child audiences (gaming, education, social) should monitor the OAIC's consultation process.
• Statutory tort for serious invasions of privacy: Individuals can now bring a civil action in court for a serious invasion of privacy. This is a significant new private right of action, separate from the OAIC's regulatory enforcement pathway.
• Automated decision-making transparency (APP 1.7–1.9): New obligations (effective 10 December 2026) require APP entities to disclose automated decision-making practices in their privacy policies. See below for full detail.
• APP 8 prescribed-country mechanism: As discussed in the cross-border section above.
• OAIC infringement notice power: The OAIC can now issue penalty notices for up to 200 penalty units for certain administrative breaches, effective immediately from 11 December 2024.

New APP 1.7 (effective 10 December 2026 — a 24-month transition from enactment) requires APP entities that use personal information in computer programs to make, or substantially contribute to, decisions that significantly affect individuals to disclose this in their privacy policy. As analysed by Johnson Winter Slattery, the privacy policy must describe:

• The kinds of personal information used in the automated program;
• The kinds of decisions made solely by such programs (i.e., without meaningful human review); and
• The kinds of decisions for which the automated processing substantially and directly relates to the final decision, even if a human makes the ultimate call.

Covered decisions include those that grant or refuse a benefit, affect rights under a contract, or affect access to a significant service or support. This captures a wide range of AI-assisted workflows: credit decisioning, insurance underwriting, candidate screening, content moderation, and personalisation engines that materially affect user access.

The practical implication for foreign tech companies is that any AI or ML pipeline that processes Australian personal information and influences outcomes for individuals must be documented and disclosed before 10 December 2026. Starting that documentation process now — as part of general AI governance — is strongly recommended. (Note: the 10 December 2026 commencement is based on commercial law-firm analysis consistent with the 24-month transition; verify against OAIC guidance as implementation instruments are published.)

Tranche 2 of the Privacy Act reforms covers proposals that were not included in the 2024 Act but were agreed in principle by the government in its Privacy Act Review response. The most significant Tranche 2 proposals include:

• Removal of the A$3 million small-business exemption — which would bring all private-sector organisations into the Privacy Act regardless of turnover;
• Enhanced individual rights — including a right to erasure (similar to GDPR's right to be forgotten), a right to object to direct marketing, and rights related to targeted advertising; and
• Further reform of the sensitive information and health information provisions.

As noted by the Attorney-General's Department, Tranche 2 draft provisions are under active consultation and the government has committed to advancing these reforms in coming months. However, no Tranche 2 legislation has been passed. Any specific timeline should be treated as a government indication only, not a legislated date. Foreign companies should design their privacy architecture to meet the higher Tranche 2 standard from the outset — retrofitting compliance after the A$3 million exemption is removed will be more costly than building it in.

New Zealand's Privacy Act 2020 came into force on 1 December 2020, replacing the Privacy Act 1993. It applies to all agencies — a term that covers any organisation or business (including overseas entities) that collects, stores, uses, or shares personal information about individuals in New Zealand, or that carries on business in New Zealand.

Structurally, the NZ Act mirrors the Australian approach: it has 13 Information Privacy Principles (IPPs) that are broadly analogous to the Australian APPs, covering collection, use, disclosure, storage, access, and correction. Key structural differences for foreign companies include:

• No turnover threshold: The NZ Act applies to all agencies regardless of size. There is no equivalent of the Australian A$3 million small-business exemption.
• Mandatory breach notification: The notifiable breach obligation was introduced by the 2020 Act (it did not exist under the 1993 Act). The OPC's stated expectation is notification within 72 hours of determining the breach is notifiable — a significantly tighter guide than Australia's 30-day practice (though the 72-hour figure is the OPC's guidance, not a hard statutory deadline, as clarified on the OPC's own website).
• Director accountability: The 2020 Act strengthened accountability for senior leaders in organisations that misuse personal information.

IPP 12 — Disclosure of Information Outside New Zealand is the NZ equivalent of APP 8. Under the NZ Privacy Act 2020, an agency may only disclose personal information to an overseas recipient if it believes on reasonable grounds that the recipient will adequately protect the information — meaning safeguards comparable to those provided by the NZ Privacy Act.

The accepted mechanisms are:

• Model contract clauses: The NZ OPC provides standard model contract clauses for inclusion in data processing agreements with overseas recipients. Using these clauses is the primary compliance pathway.
• Binding corporate rules or equivalent schemes: Where both parties are subject to an equivalent privacy regime (e.g., an EU company subject to GDPR), the agency may rely on comparable safeguards without a separate contract.
• Cloud services (important nuance): For cloud service providers, the OPC guidance confirms that in most circumstances no agreement with the cloud provider itself is required as long as the NZ agency retains control over the data and can instruct deletion or return. The cloud provider is treated as a data processor, not a separate disclosee.

Foreign companies using cloud infrastructure to serve NZ customers should document their data control arrangements and confirm they can instruct deletion to maintain this cloud-provider carve-out.

Under the NZ Privacy Act 2020, a notifiable privacy breach is one that has caused or is likely to cause serious harm to affected individuals. The criteria for assessing likelihood of serious harm are set out in section 113 of the Privacy Act 2020 and include factors such as: the sensitivity of the information, whether it could be used for identity theft or fraud, the number of individuals affected, and whether it involves vulnerable people.

When an agency determines a breach is notifiable, it must notify both the Office of the Privacy Commissioner (OPC) and affected individuals as soon as practicable. The OPC's stated expectation — explained on the OPC's website — is that notification should occur within 72 hours of the agency forming the view that the breach is notifiable. This is guidance rather than a hard statutory clock, but organisations should treat it as the operational standard.

The OPC publishes a self-assessment tool called NotifyUs and model contract clauses for cross-border transfers, both freely available at privacy.org.nz. Foreign companies should incorporate these into their incident response runbooks before launch.

Use this checklist before and immediately after launching in Australia and/or New Zealand. Items are ordered by urgency.

Pre-launch (before first data collection)

• ☐ Determine whether the Privacy Act 1988 (AU) and/or the Privacy Act 2020 (NZ) applies to your operations based on the "carries on business" and "collects personal information" tests.
• ☐ Appoint an internal privacy owner (DPO equivalent) with responsibility for ANZ privacy compliance.
• ☐ Conduct a data mapping exercise: document all personal information collected, the purposes, storage locations, and all third-party recipients (including cloud providers, analytics tools, CRM, support platforms).
• ☐ Draft or update your privacy policy to comply with APP 1 (AU) and IPP 1 (NZ): include purposes of collection, disclosure overseas, individual rights, and complaints process.
• ☐ Execute APP 8-compliant data processing agreements (DPAs) with all overseas sub-processors and vendors that receive Australian personal information.
• ☐ Execute IPP 12-compliant contracts (using the OPC's model clauses) for overseas recipients of NZ personal information.
• ☐ Confirm cloud providers are used as data processors (not disclosees) and that your organisation retains data-control rights including deletion — preserving the NZ cloud-provider carve-out.
• ☐ Review collection notices and consent mechanisms for APP 5 (notification at collection) and IPP 3 (NZ equivalent).
• ☐ For products handling sensitive information (health, financial, biometric): verify heightened obligations under APP 3 and seek specialist legal advice.

Within 30 days of launch

• ☐ Establish a data breach response plan covering AU (NDB scheme — 30-day assessment window) and NZ (OPC 72-hour guidance).
• ☐ Designate a breach response lead and test the incident response process against a tabletop scenario.
• ☐ Register with the OAIC's NDB notification portal and the NZ OPC's NotifyUs tool.
• ☐ Implement individual access and correction request workflows (APP 12–13 / IPP 6–7).

By 10 December 2026

• ☐ Audit all AI/ML and automated decision-making systems that use Australian personal information.
• ☐ Update your Australian privacy policy to include APP 1.7-compliant disclosures of automated decision-making practices before the deadline.
• ☐ Monitor OAIC consultation on the Children's Online Privacy Code if your product is accessible to minors.

Ongoing

• ☐ Monitor Tranche 2 Privacy Act reform progress — particularly the proposed removal of the A$3 million exemption.
• ☐ Annually review sub-processor list and DPAs.
• ☐ Conduct a privacy impact assessment (PIA) for any new product feature that significantly changes how personal information is handled.

Q: We are a pure B2B SaaS provider. Do we still need to comply with the Privacy Act?
A: Yes. Even if your direct customers are Australian businesses, your product almost certainly processes personal information about those businesses' employees, end-users, or customers. As an APP entity handling that information, you are subject to the APPs. The B2B nature of your commercial relationship does not remove the obligation — it may affect the allocation of responsibilities between you and your customers via contractual terms.

Q: Our data is hosted in the US on AWS. Does that mean we are breaching APP 8?
A: Not automatically. APP 8 requires you to take reasonable steps — typically a DPA — to ensure the overseas recipient (in this case, your AWS entity) handles the data consistently with the APPs. AWS offers a Data Processing Addendum that can satisfy this requirement. For large-scale enterprise deployments, customers may require data to be hosted in AWS's Sydney region (ap-southeast-2) to avoid APP 8 entirely for their data subset.

Q: Is a GDPR-compliant privacy programme sufficient for Australia and New Zealand?
A: It is a strong foundation, but not sufficient on its own. Key gaps include: (1) the APPs do not require a lawful basis for processing in the same way GDPR does — consent is not required for all processing; (2) there is no right to data portability under current AU law (proposed in Tranche 2); (3) APP 8 accountability under section 16C is broader than GDPR's accountability for processors; and (4) the NZ 72-hour breach notification guidance is tighter than GDPR's 72-hour hard deadline in practical terms. A gap analysis against the APPs and IPPs is recommended.

Q: When do the automated decision-making transparency rules take effect in Australia?
A: New APP 1.7 takes effect on 10 December 2026 — 24 months after the Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. This commencement date is based on commercial law-firm analysis of the Act, consistent with the 24-month transition provided; verify against any implementation instruments published by the AG's Department.

Q: Does Australia have a data localisation law requiring data to stay in Australia?
A: Australia does not have a general data localisation mandate. The Privacy Act regulates cross-border disclosure via APP 8 but does not prohibit it — it requires appropriate safeguards. Sector-specific requirements (e.g., certain government data under the Protective Security Policy Framework, or health data in some state jurisdictions) may impose additional constraints. Cloud or government contracts frequently include data residency clauses as a commercial requirement even where law does not mandate them.

Q: How does the NZ Privacy Act 2020 treat overseas companies with no NZ entity?
A: Foreign companies that carry on business in New Zealand or collect personal information from people in New Zealand are subject to the NZ Privacy Act 2020, regardless of whether they have a local entity. The OPC can investigate complaints about overseas entities and has powers to require compliance. Foreign companies should treat NZ obligations as applying from the moment they have NZ users or customers.