Is hosting Australian customer data on EU servers a cross-border disclosure under APP 8?
Short answer
- Not automatically. The OAIC says giving personal information to an overseas provider purely for storage can be a 'use', not a 'disclosure', when your contract keeps you in effective control of it.
- Effective control means a binding contract limits the provider to storage and handling for your purposes, binds its subcontractors to the same terms, and leaves you able to access, change, retrieve and delete the data.
- If the arrangement is a disclosure instead, APP 8.1 requires reasonable steps so the overseas recipient does not breach the APPs, and under s16C you stay accountable for its acts.
- The Notifiable Data Breaches scheme still applies to you: an eligible data breach at your provider is your breach to assess and, where required, notify.
- Whether a given arrangement is use or disclosure depends on your contract and facts. Get your own legal advice; a hosting provider cannot make that call for you.
What the law says: APP 8, s16C and the OAIC guidance
APP 8.1 in Schedule 1 of the Privacy Act 1988 (Cth) says that before an APP entity discloses personal information to an overseas recipient, it must take reasonable steps to ensure the recipient does not breach the APPs. Section 16C then makes the entity accountable: an act or practice of the overseas recipient that would breach the APPs is treated as the entity's own breach, even if reasonable steps were taken (OAIC APP Guidelines, paras 8.60–8.62).
The key question is whether sending data to an EU host is a disclosure at all. The OAIC (paras 8.14–8.15) says providing personal information to an overseas cloud provider for the limited purpose of storing and managing it can be a use where a binding contract restricts the provider to those purposes, requires subcontractors to accept the same obligations, and gives you effective control, including the right to access, change or retrieve the information. If that holds, APP 8 and s16C are not triggered, but you remain responsible for that information under the other APPs, including APP 11 security.
Primary source: OAIC, Australian Privacy Principles Guidelines, Chapter 8.
Notifiable Data Breaches and the 2024 amendments
Part IIIC of the Privacy Act, the Notifiable Data Breaches scheme, requires you to assess a suspected eligible data breach and notify the OAIC and affected individuals where serious harm is likely. Where the data sits with a hosting provider under your control, the breach is still yours to handle, so your contract should require the provider to tell you promptly about incidents.
The Privacy and Other Legislation Amendment Act 2024 added an APP 8.2 exception for countries or binding schemes prescribed by regulation, applying to information disclosed from 11 December 2024 (OAIC ch. 8, paras 8.28–8.30). It only helps if the destination is actually prescribed, so check the regulations at the time you rely on it.
Three typical Australian scenarios
- A Melbourne SaaS company adding EU data residency. It hosts European customers' data in Frankfurt to meet their GDPR requirements. Any Australian personal information stored there is assessed under the same use-or-disclosure test.
- A Sydney agency running backups offshore. Encrypted backups kept in the EU, where the agency holds the keys and can retrieve or delete them at will, fit the storage-only pattern the OAIC describes, provided the contract says so.
- A Brisbane retailer handing data to a provider that also analyses it. If the provider may use the data for its own purposes, that points towards a disclosure, with APP 8.1 and s16C applying.
Common mistakes
- Assuming "it's only hosting" settles the question without checking what the contract actually allows the provider to do.
- Forgetting subcontractors: effective control requires them to be bound by the same limits.
- Leaving the privacy policy silent on overseas locations when APP 1 and APP 5 call for them.
- Having no incident-notification clause, which makes NDB assessment deadlines hard to meet.
- Treating GDPR compliance in the EU as if it automatically satisfied Australian law.
How 4hosting helps
Our datacentre is in the European Union, in Frankfurt, not in Australia, and we say so up front. Expect noticeably higher latency for users in Australia than a local datacentre would give you.
- A GDPR Article 28 data processing agreement, plus Standard Contractual Clauses for transfers, as a contractual base you and your adviser can review against the OAIC's effective-control conditions.
- Root access on VPS and dedicated servers, so you control access, encryption keys and deletion.
- DevOps and CyberSecurity hours included in VPS, dedicated and GPU plans, and from cPanel Advanced upwards, for hardening, backups and logging.
- Billing in EUR.
4hosting is not a compliance certifier and does not give legal advice. Whether your arrangement is a use or a disclosure under the Privacy Act is for you and your advisers to decide.
Frequently asked questions
Does GDPR adequacy or EU law make the EU a 'prescribed country' for APP 8?
Not by itself. The Privacy and Other Legislation Amendment Act 2024 created an exception for countries or schemes prescribed by regulation, applying to disclosures from 11 December 2024. Check the current regulations before relying on it; do not assume a country is listed.
If my EU host is only storing data, do I still need a privacy policy mention?
APP 1 and APP 5 require you to tell individuals whether you are likely to disclose their information overseas and, where practicable, the countries. If your arrangement is a use rather than a disclosure, review the wording with your adviser so it stays accurate.
Is latency a problem for Australian users on EU servers?
Physical distance between Australia and Europe adds noticeable round-trip delay. For admin tools, back-office systems or data you serve mainly to European customers this is usually acceptable; for latency-sensitive consumer apps in Australia it may not be.