The Privacy Act and your Australian subsidiary: coverage, overseas transfers and breaches

Australia's Privacy Act 1988 applies to most foreign-owned Australian companies, often including small ones. A Pty Ltd is an "APP entity" bound by the 13 Australian Privacy Principles unless it qualifies as a small business operator, and a subsidiary of a larger group usually doesn't. Sending personal information to the overseas parent triggers APP 8. A serious data breach has to be assessed within 30 days and reported to the Office of the Australian Information Commissioner (OAIC). The 2024 amendments added a statutory tort, new mid-level and lower penalty tiers and, from 10 December 2026, automated decision disclosures. This guide sets out what applies and what the board should ask.

Is your company covered?

The Australian Privacy Principles (APPs) bind "APP entities": Commonwealth agencies and private sector organisations, but generally not small business operators. Coverage turns on section 6D of the Privacy Act.

The $3 million test

A business is a small business in a financial year if its annual turnover for the previous financial year was $3,000,000 or less (s6D(1)). A new business with no previous year looks at its current year (s6D(2)). But an entity is not a small business operator if any business it carries on has had turnover of more than $3,000,000 in a financial year that ended after it started that business (s6D(4)(a)). Once you cross the line, you stay over it.

The OAIC's small business guidance says annual turnover includes all income from all sources, but not assets held, capital gains or proceeds of capital sales. The government's business.gov.au guidance puts it simply: over $3 million, you must comply, and some businesses with smaller turnovers still need to.

The exceptions that catch foreign-owned subsidiaries

Even under $3 million, an entity is not a small business operator if it:

• is related to a larger business. Section 6D(9) says a body corporate is not a small business operator if it is related to a body corporate that carries on a business that is not a small business. "Related" uses the Corporations Act test, so holding companies and subsidiaries are related to each other.
• provides a health service and holds health information other than in an employee record (s6D(4)(b)).
• trades in personal information, meaning it discloses personal information for a benefit, service or advantage, or pays to collect it, unless it has consent or the law requires or authorises it (s6D(4)(c) and (d), (7) and (8)).
• is a contracted service provider under a Commonwealth contract (s6D(4)(e)), or a credit reporting body (s6D(4)(f)).

The OAIC lists further categories covered regardless of turnover, including reporting entities under the AML/CTF Act and residential tenancy database operators.

The related body corporate point needs care. The Act's wording focuses on whether the related company carries on a business that is "not a small business", which is a turnover question. The OAIC's checklist asks whether your business is related to "a larger body corporate that is subject to the Privacy Act". For an Australian subsidiary of a large foreign group, those two readings can give different answers, because the overseas parent may not itself be an APP entity. Don't assume the exemption. Get privacy advice on your group structure, or simply comply: the OAIC recommends small businesses consider opting in.

Overseas acts and the "Australian link"

Section 5B(1A) extends the Act to acts and practices outside Australia by an organisation with an Australian link. A body corporate incorporated in Australia has one automatically (s5B(2)(e)). A foreign company also has one if it carries on business in Australia (s5B(3)). So the Australian subsidiary's obligations follow its data to overseas servers, and a foreign parent that trades here directly may be covered in its own right.

The employee records exemption

An employer's handling of an employee record is exempt where it directly relates to the current or former employment relationship (s7B(3)). This is narrower than many groups assume. It doesn't obviously extend to job applicants or contractors, and it doesn't switch off the separate rules for tax file numbers. See hiring employees in Australia for the wider employment set-up.

APP 8: sending data to the overseas parent

This is where foreign-owned groups most often go wrong. Group HR systems, a global CRM and shared service centres all involve moving Australian personal information offshore.

APP 8.1 says that before an APP entity discloses personal information to an overseas recipient that is not the entity itself, it must take reasonable steps to ensure the recipient does not breach the APPs (other than APP 1). Key points from the OAIC's APP 8 guidelines:

• The parent is a different entity. Sending information to an overseas office of the same entity is not a disclosure to an overseas recipient. Sending it to a related body corporate overseas is.
• Section 13B doesn't help here. Section 13B lets related bodies corporate share non-sensitive personal information without it being an interference with privacy. The OAIC says it does not exempt an APP entity from complying with APP 8 before it discloses to a related body corporate located overseas.
• The usual reasonable step is a contract. The OAIC generally expects an enforceable contractual arrangement requiring the recipient to handle the information in line with the APPs, flowing down to subcontractors, with complaint handling and a data breach response plan.
• Cloud storage can be a "use". Giving data to an overseas cloud provider purely to store it, under a contract that limits the provider to that purpose and leaves the entity in effective control, may be a use rather than a disclosure.

You remain accountable

Under s16C, if the overseas recipient does something that would breach the APPs, the Australian entity is treated as having done it. The OAIC notes this can apply even where the entity took reasonable steps. That is why the intra-group data transfer agreement matters.

Exceptions in APP 8.2

APP 8.1 does not apply where, among other things:

1. the entity reasonably believes the recipient is subject to a law or binding scheme substantially similar to the APPs, with mechanisms the individual can use to enforce it
2. the recipient is subject to the laws of a country, or a binding scheme, prescribed by regulations (APP 8.3, added in 2024; check with your adviser whether any country has been prescribed, as this guide doesn't assume one has)
3. the individual is expressly told APP 8.1 won't apply and consents
4. the disclosure is required or authorised by an Australian law or court order.

Relying on "the parent's home country has a good privacy law" is a judgment the entity has to be able to justify. Most groups find a contract simpler.

Data breaches: two separate clocks

The Notifiable Data Breaches scheme in Part IIIC of the Act applies to APP entities and also to tax file number recipients. The OAIC's NDB scheme guidance notes that a small business required to secure TFN information only has to notify breaches affecting that information. Any company with employees in Australia collects TFNs, so this reaches even exempt subsidiaries.

An eligible data breach is unauthorised access to, or disclosure of, personal information (or its loss where that is likely) that a reasonable person would conclude is likely to result in serious harm to any affected individual (s26WE).

The 30 days is a cap on assessment, not a grace period for notifying. The statement must include the entity's identity and contact details, a description of the breach, the kinds of information involved, and recommended steps for individuals. The OAIC asks entities to report through its online form.

If the breach happens in the parent's systems, the Australian entity is still responsible for its own data. Your intra-group agreement should require the parent to tell the Australian entity promptly, so the 30-day assessment can start.

The 2024 amendments

The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. Its main parts have different start dates.

Penalty tiers (in force)

The top tier for a serious interference with privacy (s13G) was raised to its current levels by the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 (No 83 of 2022). The 2024 Act amended s13G and added the s13H and s13K tiers below it.

In deciding whether an interference is "serious", a court can consider factors including the sensitivity of the information, the number of people affected, whether children were involved, and whether the entity failed to put compliance systems in place (s13G(1B)).

Statutory tort (commenced 10 June 2025)

Schedule 2 of the Privacy Act now gives individuals a cause of action for serious invasions of privacy, by intrusion upon seclusion or misuse of information. The plaintiff must show that a person in their position would have had a reasonable expectation of privacy in all the circumstances, that the invasion was intentional or reckless and serious, and that the public interest in their privacy outweighed any countervailing public interest (such as freedom of the media, open justice or public health and safety). It is actionable without proof of damage. The tort is separate from the APPs and isn't limited to APP entities.

Automated decisions (from 10 December 2026)

New APP 1.7 to 1.9 commence on 10 December 2026. If an entity has arranged for a computer program to make a decision, or do something substantially and directly related to making one, that could reasonably be expected to significantly affect an individual's rights or interests, and personal information is used, the APP privacy policy must describe the kinds of personal information used and the kinds of decisions involved. A breach is listed in s13K. If the group runs automated credit, pricing, hiring or eligibility tools on Australian data, the privacy policy needs updating now.

What directors should ask

Privacy failures land on the board. A director who never asked whether the company was covered is in a weak position under the duty of care (see director duties). Practical questions:

1. Are we an APP entity? Has someone tested s6D, including s6D(9), against our group structure, and written it down?
2. What personal information do we hold, and where? Customers, employees, applicants, TFNs, health information.
3. What leaves Australia? Which systems sit with the parent or offshore vendors, and is there a signed intra-group agreement covering APP 8?
4. Do we have a current APP privacy policy? Does it name the countries data is likely to go to, and will it cover automated decisions from 10 December 2026?
5. What is our breach plan? Who decides a breach is "eligible", who notifies the OAIC, and how fast will the parent tell us?
6. Who owns this? A named person in Australia with authority to act, not just a global privacy team in another time zone.

Document the answers in board papers or minutes. Our record-keeping guide covers what the minute book needs.

Where we fit

A resident director is entitled to see how the company handles personal information and to ask these questions. We don't provide privacy legal advice, and a group with significant Australian customer data should engage a privacy lawyer. Our governance packages include board-level oversight of compliance matters like this; see pricing.

This page is general information, current at 28 October 2026, and is not legal advice. Privacy obligations depend on your company's facts; confirm your position with an Australian privacy lawyer.

General information about Australian law and practice, not legal or tax advice for your circumstances. Check the official sources, or ask your adviser, before you act.