Home › Guides › Overseas disclosure and offshore CRMs: APP 8 for real-estate agencies

title: "Overseas disclosure and offshore CRMs: APP 8 for real-estate agencies" slug: overseas-disclosure-offshore-crm-real-estate-app8 type: answer-page status: draft (Phase-1, claim-free) · regulatory claims → Gate-A lawyer eye before loud maps_to: APP 8, s 16C, APP 8.2, APP 5, APP 1.3, s 6D, s 6E(1A) targets: "real estate crm data overseas app 8", "is my property crm hosted overseas privacy", "app 8 cross border disclosure real estate", "does real estate crm store data in the us privacy", "overseas disclosure privacy policy real estate agency" updated: 2026-07-22

By Jon Oates, Founder of Privaproof · Last updated 22 July 2026 · Start the free 2-min audit →

Overseas disclosure and offshore CRMs: APP 8 for real-estate agencies

If your agency is covered by the Privacy Act and your CRM, cloud storage, email or offshore staff put client data outside Australia, that generally triggers APP 8. You must take reasonable steps to ensure the overseas recipient handles the data consistently with the Australian Privacy Principles, and an accountability rule (s 16C) can keep your agency responsible for what happens to it offshore.

General information, not legal advice. Whether the Privacy Act applies, and how, depends on your agency's circumstances.

When does a real-estate agency's data actually go overseas?

The honest answer is "more often than most principals realise, and usually through software rather than a decision anyone made out loud." A real-estate agency sends personal information overseas whenever a tool that holds that information stores or processes it outside Australia. The three common routes are: a CRM or trust/PM platform hosted overseas (some property CRMs and cloud tools default to US or other offshore infrastructure, check your own vendor's data-residency); general cloud services (email, file storage, e-signature, screening add-ons) whose default region isn't Australia; and offshore staff or virtual assistants who access your systems from another country. You don't have to be "exporting" data deliberately for APP 8 to be in play; hosting client records on an overseas server, or giving an offshore team member a login, is generally enough. The first practical move is simply knowing where each system keeps its data, because you can't manage an exposure you can't see.

For the labour-and-access side of this specifically (offshore VAs and property-management providers), see offshore VAs and overseas data under APP 8. This page focuses on the software and hosting side.

What does APP 8 require, and what is the s 16C accountability rule?

APP 8 governs cross-border disclosure of personal information. Before an APP entity discloses personal information to an overseas recipient, it must take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles in relation to that information (OAIC APP Guidelines, Chapter 8). Sitting behind APP 8 is an accountability layer in section 16C of the Privacy Act 1988 (Cth): if the overseas recipient does something that would have breached the APPs, the disclosing entity can be treated as having done that act itself, unless an APP 8.2 exception applies. In plain terms, sending data offshore doesn't send the responsibility with it. That is the core reason "we just use whatever CRM the office has always used" isn't a safe position: you are expected to have taken reasonable steps, and to be able to show it.

Does hosting client data on an overseas server count as "disclosure"?

Often yes, and the safest course is to treat it as one. Whether a particular arrangement is a "use" (you keep effective control) or a "disclosure" (the data moves outside your effective control) is fact-specific and can turn on the contract and the setup. Some purely passive storage arrangements may be characterised differently, but for a busy agency the defensible approach is to assume that putting client personal information on an overseas-hosted CRM or cloud service engages APP 8, and to comply, rather than to bet the agency on a fine legal distinction that hasn't been tested for your exact stack. If you want certainty for an unusual arrangement, that's a question for a lawyer.

Are the APP 8.2 exceptions a reliable get-out?

Two exceptions matter for agencies, and neither is automatic. Under APP 8.2(a), reasonable steps aren't required if you reasonably believe the overseas recipient is bound by a law or scheme that is substantially similar to the APPs and that the individual can enforce. Under APP 8.2(b), the individual consents after being expressly told that if they consent, APP 8 protections won't apply. The trap is assuming 8.2(a) covers you just because a country "has a privacy law"; that judgment is fact-specific and untested for most vendors, so don't lean on it without advice. And genuine 8.2(b) consent is a specific, informed step, not a buried line in a policy nobody reads. For most agencies, the cleaner path is to take reasonable steps under APP 8.1 (due diligence plus a contract that binds the provider to APP-equivalent handling) rather than to rely on an exception.

What must your privacy policy and collection notices disclose?

If you're likely to send personal information overseas, you generally have to say so, in two places. Your privacy policy must state whether you are likely to disclose personal information to overseas recipients and, if practicable, the countries where they're located (APP 1.3–1.4). Your collection notice given at the point you collect the information must, where you're likely to disclose overseas, tell the individual that, and generally identify the likely countries where practicable (APP 5). So a "no overseas disclosure" line in your policy while your CRM runs on US servers is a mismatch worth fixing. Being straight about where data goes isn't just an APP 8 issue; it's part of the transparency the Privacy Act expects (see privacy policy vs collection notice and the APP 5 collection notice).

Is a small agency even caught by this?

Not every small agency is an APP entity, but the exceptions are wide, so check before assuming you're out. Under section 6D, a business with annual turnover of A$3 million or less is generally exempt from the Privacy Act. That small-business exemption still exists (a broader removal has been proposed but is not law). However, the exemption falls away for the whole business in several situations, for example where you trade in personal information, are related to a larger entity, provide services to the Commonwealth, or opt in. AML/CTF works differently: it is a partial carve-in, not a whole-business trigger. From 1 July 2026, agencies providing designated real-estate (sales) services are AUSTRAC reporting entities, and via section 6E(1A) the Privacy Act attaches only to the personal information handled for AML/CTF (KYC/identity) purposes, not your whole CRM or business, even below the $3m threshold. So if that identity data is processed or stored by an overseas-hosted tool, APP 8 can reach it. See does the Privacy Act apply to real-estate agents and ID documents, AUSTRAC and privacy.

Practical steps: find out where your CRM stores data, then close the gap

Reasonable steps are a short sequence, not a signature. You don't need a data-protection department; you need to know where your data lives and to have taken sensible, documented steps.

This is general guidance on a defensible order of operations, not a legal determination for your agency.

Next steps

Two ways to get a grip on overseas disclosure:

1. See where you stand (free). The free 2-minute Privacy Readiness self-audit flags whether your CRM, cloud tools or offshore staff arrangements are exposing you under APP 8. 2. Fix it properly. The Privaproof Kit includes the privacy policy and APP 5 collection-notice wording that handle overseas disclosure honestly, ready to adapt for your agency.

→ Start the free 2-minute self-audit

Common questions

Does using a US-hosted real-estate CRM breach the Privacy Act?

Not by itself. Using an overseas-hosted CRM is generally an overseas disclosure that engages APP 8, which requires you to take reasonable steps to ensure the provider handles the data consistently with the APPs and to disclose the arrangement in your policy and notices. It's a manageable obligation, not an automatic breach, provided you actually take those steps.

How do I find out whether my CRM stores data overseas?

Check the provider's data-location, hosting or security documentation, and if it isn't clear, ask them directly and get the answer in writing. Some providers offer an Australian hosting region you can select. Knowing the answer is the single most useful thing you can do, because it determines whether APP 8 applies at all.

Is my agency responsible if an overseas provider mishandles client data?

Potentially yes. Under section 16C an entity can be treated as having done the overseas recipient's act itself, as if it had breached the APPs, unless an APP 8.2 exception applies. Taking reasonable steps under APP 8, backed by a contract binding the provider to APP-equivalent handling, is what protects you.

Do I have to mention overseas disclosure in my privacy policy?

If you're likely to disclose personal information overseas, your privacy policy should say so and, where practicable, identify the likely countries (APP 1.3–1.4), and your collection notice should reflect it too (APP 5). A "we don't send data overseas" line while your software runs on offshore servers is a mismatch worth correcting.

We're a small agency under $3 million turnover, does APP 8 still apply?

It can. The $3m small-business exemption under section 6D still exists, but it falls away in several situations, including where you're an AML/CTF reporting entity. From 1 July 2026, for agencies providing designated real-estate services, section 6E(1A) attaches the Privacy Act to the KYC/identity data you handle for AML/CTF purposes, so if that data sits on an overseas-hosted tool, APP 8 can reach it even below the threshold.

Can I just rely on consent to send data overseas?

Genuine consent under APP 8.2(b) is possible, but it's a specific, informed step: the individual must be expressly told that if they consent, APP 8 protections won't apply. A buried line in a policy usually won't qualify. For most agencies, taking reasonable steps under APP 8.1 (due diligence plus a binding contract) is the more reliable path than relying on an exception.

This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice, and it does not assess your AML/CTF obligations, which are administered by AUSTRAC. Whether an APP 8.2 exception applies, or whether a particular arrangement is a "use" or a "disclosure", depends on your circumstances and on an overseas country's laws; get advice before relying on an exception. Sources: OAIC, APP 8 cross-border disclosure (APP Guidelines, Chapter 8); OAIC, APP 1 and APP 5 guidelines; Privacy Act 1988 (Cth) ss 6D, 6E(1A), 16C and APP 5 & APP 8; AUSTRAC, real estate professionals.

Last reviewed: 22 July 2026.