Car dealers, offshore finance and cloud tools: your APP 8 duty
If your dealer management system, CRM, finance-aggregation platform, marketing tool or back-office processing stores or handles customer data outside Australia, that is a disclosure overseas and APP 8 applies. Before you send it, you must take reasonable steps to ensure the overseas recipient handles it consistently with the Australian Privacy Principles. And in many cases you remain accountable for what that recipient does with it, as if you had done it yourself.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
Where a dealership's data goes offshore
It is easy to miss how often dealership data crosses the border:
- a dealer management system (DMS), CRM or cloud storage hosted overseas,
- a finance-aggregation platform that routes a buyer's application to lenders through overseas infrastructure,
- an offshore back-office, call centre or virtual assistant handling enquiries or data entry,
- an overseas marketing or analytics tool.
Each is a disclosure of customer personal information overseas, and APP 8 governs it.
The rule: reasonable steps, and you stay on the hook
Under APP 8.1, before you disclose personal information to an overseas recipient, you must take reasonable steps to ensure the recipient does not breach the APPs in handling it. The teeth are in the accountability rule (s 16C): broadly, an act by the overseas recipient that would breach the APPs is treated as if you did it, so a mishandling offshore can become your breach. That is why "it is just our software provider" does not offload the obligation, especially for the finance data, which is the most sensitive thing you send.
There are limited exceptions (APP 8.2), for example where the recipient is subject to a law or scheme substantially similar to the APPs with a way to enforce it, or where the customer is expressly informed the protection will not apply and consents. These are specific and fact-dependent, so work out your basis deliberately rather than assuming one applies.
What reasonable steps look like
- Know where your data actually is. Map which systems and providers hold customer data and in which countries, including your DMS, CRM, finance platform and any offshore processing.
- Bind your providers by contract to handle the data consistently with the APPs (purpose limits, security, breach notification, no further disclosure).
- Limit what goes offshore, especially finance and identity data.
- Tell customers. Your APP 5 collection notice must disclose that information is likely to go overseas and, where practicable, the countries. Read: the collection notice a dealership needs
- Cover a breach. Offshore-held data breached is still your Notifiable Data Breaches responsibility. Read: a data-breach response plan for car dealers
Common questions
Our DMS is a big overseas cloud platform. Are we disclosing overseas?
If it stores or processes customer data outside Australia, then yes, and APP 8 is engaged, even for a routine, well-known platform. Confirm the hosting location and handle it on the APP 8 basis rather than assuming the vendor takes you out of scope.
The finance platform sends applications through overseas servers. Does that count?
If a buyer's finance data is processed or stored overseas, that is an overseas disclosure and APP 8 applies. Finance data is the most sensitive thing you handle, so this is exactly where reasonable steps and accountability matter most.
Is there a list of "safe" countries we can send data to freely?
No. There is no prescribed safe-country whitelist that removes your obligation. The default is to take reasonable steps to ensure the recipient meets the APPs, and you stay accountable, so work out your APP 8 basis for each arrangement.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether an APP 8 exception applies to your arrangement depends on the facts. Privaproof's car-dealer documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.