Last updated: 30 October 2026. Written by the FreeMyCloud team.
Checked against the Privacy Act 1988 and the Privacy (Tax File Number) Rule 2015 on the Federal Register of Legislation on 30 October 2026.
- Sending bookkeeping work offshore is lawful in Australia. The rules govern who you tell, what you agree in writing, and how access is controlled.
- The Australian Privacy Principles bind businesses turning over more than $3,000,000. At or below that, most fall outside them as small business operators.
- APP 8 requires reasonable steps to ensure an overseas recipient does not breach the APPs.
- Tax file numbers are the exception: the Privacy (Tax File Number) Rule 2015 binds every file number recipient, whatever the turnover.
- Section 16C makes your business answerable for the overseas recipient’s acts.
- A suspected eligible data breach must be assessed within 30 days, and a confirmed one reported to the Information Commissioner as soon as practicable.
What stops most Australian business owners using an offshore bookkeeper is not accuracy. It is what happens to the data: payroll files hold tax file numbers, bank details and home addresses. This guide sets out the legal position for offshore bookkeeping in Australia, the controls that matter, and what to ask a provider before you sign.
Is offshore bookkeeping safe for an Australian business?
Offshore bookkeeping is lawful in Australia: nothing in the Privacy Act 1988 prohibits accounting work being done outside the country. Safety comes down to three things with little to do with geography: who can get into your accounting file, what they are contractually bound to do with what they see, and whether you can revoke that access at will.
Those controls matter just as much locally, and the jobs a bookkeeper does are the same either way. What differs offshore is one extra layer of law: the cross-border disclosure rule.
Two questions get merged: whether the Australian Privacy Principles cover your business at all, which turns on turnover, and what you must do if they do. Many Australian small businesses find the first answer is no, then find tax file numbers bind them anyway.
What does the Privacy Act 1988 require before data goes overseas?
The Privacy Act 1988 applies to APP entities, which for private businesses means organisations other than small business operators. Section 6D(1) defines a small business as one whose annual turnover for the previous financial year was $3,000,000 or less, and at or under that line the Australian Privacy Principles generally do not bind you.
The exemption is narrower than it sounds. Section 6D(4) pulls a business back in regardless of turnover if it provides a health service and holds health information, trades in personal information, is a Commonwealth contracted service provider, or is a credit reporting body. A medical or allied health practice is covered from its first dollar of revenue.
| Your business | Bound by the Australian Privacy Principles? | Source |
|---|---|---|
| Turnover above $3,000,000 last financial year | Yes | s 6D(1) |
| Turnover of $3,000,000 or less | Generally no, you are a small business operator | s 6D(1), s 6D(3) |
| Provides a health service and holds health information | Yes, whatever the turnover | s 6D(4)(b) |
| Buys or sells personal information | Yes, whatever the turnover | s 6D(4)(c), (d) |
| Contracted service provider for a Commonwealth contract | Yes, whatever the turnover | s 6D(4)(e) |
| Holds tax file number information | The TFN Rule binds you either way | s 17, s 18 |
Section 6D(1) measures turnover for the previous financial year. Cross it and the Australian Privacy Principles apply, including APP 8 before personal information goes offshore.
One carve-out matters for payroll. Section 7B(3) exempts acts directly related to a current or former employment relationship and an employee record held by the employer, so your own employee records sit outside the APPs. Customer, supplier and contractor information does not, and neither do tax file numbers.
Which Australian Privacy Principles apply to offshore bookkeeping?
Two principles carry most of the weight. If your business is an APP entity they apply directly; if not, they remain the best standard to hold a provider to.
APP 8.1 is the cross-border rule. Before an APP entity discloses personal information to a recipient outside Australia, it must take such steps as are reasonable in the circumstances to ensure that recipient does not breach the Australian Privacy Principles, other than APP 1. The obligation sits on your business, not the provider, which is why a signed confidentiality agreement and an engagement letter naming the arrangement matter, whether the file sits in Xero or any other package.
APP 8.2 lists exceptions, including where you reasonably believe the recipient is bound by a law or scheme protecting the information in a way overall at least substantially similar to the APPs. Most bookkeeping arrangements rely on the reasonable steps route instead.
APP 11.1 is the security rule and applies wherever the information sits: reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. APP 11.2 adds the half businesses forget. Once the information is no longer needed and no Australian law requires it be kept, reasonable steps must be taken to destroy or de-identify it.
Section 16C of the Privacy Act 1988 says that where APP 8.1 applied to a disclosure and the overseas recipient does something that would breach the APPs, that act is taken to have been done by the Australian business, and to be a breach by it. Responsibility does not travel offshore with the data.
What happens to tax file numbers when a bookkeeper works offshore?
This catches out businesses under the $3,000,000 line, because tax file numbers are not governed by turnover. Section 17 of the Privacy Act 1988 requires the Information Commissioner to issue rules on the collection, storage, use and security of tax file number information, and section 18 says a file number recipient must not breach them. Those rules are the Privacy (Tax File Number) Rule 2015, binding every file number recipient regardless of size.
Rule 11 is the operative one. TFN recipients must take reasonable steps to protect that information from misuse, loss and unauthorised access, use, modification or disclosure, and to restrict access to records containing it to those who need to handle it for taxation, personal assistance or superannuation law purposes. That argues directly for named user accounts rather than a shared login, and it is one reason outsourced bookkeeping from the Philippines is set up inside the client’s own file.
Rule 11(2) requires reasonable steps to securely destroy or de-identify that information once it is no longer required by law or necessary for those purposes, and Rule 12 requires staff training on when it may be collected, the prohibitions on use and disclosure, and the sanctions for breach. If your bookkeeping includes payroll, tax file numbers are in scope from the first pay run, so the same controls belong on an outsourced payroll service.
What does the Notifiable Data Breaches scheme require?
Part IIIC of the Privacy Act 1988 creates the Notifiable Data Breaches scheme. Section 26WE(1) reaches APP entities bound by APP 11.1, credit reporting bodies, credit providers, and in paragraph (d) file number recipients holding tax file number information. That last limb matters, because holding tax file numbers can bring a small business inside the scheme even where the APPs do not bind it.
Section 26WE(2) defines an eligible data breach: unauthorised access to or disclosure of the information where a reasonable person would conclude it would be likely to result in serious harm to any individual concerned. Information lost in circumstances where such access or disclosure is likely, and would likely cause serious harm, counts as well.
| Stage | What the Act requires | Timing |
|---|---|---|
| You suspect there may have been an eligible data breach | A reasonable and expeditious assessment of whether there are grounds to believe one has happened | All reasonable steps to finish within 30 days of becoming aware (s 26WH(2)) |
| You have reasonable grounds to believe one has happened | Prepare a statement and give a copy to the Information Commissioner | As soon as practicable (s 26WK(2)) |
| What the statement must contain | Your identity and contact details, a description of the breach, the kinds of information involved, and recommended steps for individuals | s 26WK(3) |
The clock starts when you become aware of grounds to suspect a breach, so your provider must tell you quickly. A contract obliging them to report suspected unauthorised access without delay makes that window workable.
How do you keep control of access with an offshore bookkeeper?
The obligations above point at one arrangement, and it is one you control rather than take on trust. Your file stays yours, and the bookkeeper is invited in as a named user at a permission level you set, revocable at any time.
That structure does most of the work. Rule 11 asks you to restrict access to those who need to handle the information, and a named account is exactly that, keeping entries attributable to a person. Shared credentials defeat that, which makes them worth refusing.
The second control is contractual. Written terms are how APP 8.1 reasonable steps are normally met: an engagement letter naming the arrangement, and a signed confidentiality agreement covering the staff who touch the file. A published privacy policy should also say that information may be handled overseas, as FreeMyCloud does in its privacy policy.
The third is operational: how documents reach the bookkeeper. Statements emailed to a personal address are weaker than documents loaded into the software, and the same discipline applies to any virtual bookkeeper, onshore or off.
What should you ask an offshore bookkeeping provider before signing?
| Ask | What a clear answer sounds like | Why it matters |
|---|---|---|
| Who exactly will have access, and where do they sit? | Named people in a stated country, own logins | APP 8 turns on disclosure outside Australia |
| Do I create the user accounts, or do you? | You create them in your own file and set the permission level | Access, and revoking it, stays with you |
| Will the staff sign a confidentiality agreement? | Yes, and you can see it before you start | The usual way of meeting APP 8.1 |
| How are tax file numbers handled and stored? | Inside the payroll software, access limited to those who need it | TFN Rule 11 applies whatever your turnover |
| If you suspect unauthorised access, when do you tell me? | Immediately, in writing | Your 30 day clock starts when you become aware |
| What happens to my data when we stop? | Access removed, copies destroyed or de-identified | APP 11.2 and TFN Rule 11(2) |
| Who lodges my BAS and tax returns? | A registered agent, not the bookkeeping provider | Paid BAS and tax services require registration |
That last line is a common misunderstanding rather than a security question, and our guide to who does what between a bookkeeper, a BAS agent and an accountant explains each boundary.
When is offshore outsourcing not the right fit?
Some businesses are better served another way. If the role needs someone present, handling cash or on a front desk, an employee on your premises suits you better. If you need two or three hours a month, a local contractor is simpler. If your regulator or a client contract requires data held onshore, that decides the question before privacy law does.
Outsourcing works best where the work is defined and repeatable, which is most bookkeeping. Where a role is mostly judgement calls made in the room with you, a local hire earns its cost. Our comparison of outsourced bookkeeping services and the page on what a bookkeeper costs set out the trade-offs.
How does FreeMyCloud handle access and confidentiality?
FreeMyCloud has placed university-qualified graduate accountants based in the Philippines with Australian businesses since 2010, from individual operators to ASX-listed companies. Your accountant works inside your own accounting file, using a user account you create at the permission level you choose, and you can remove that access at any time. FreeMyCloud is able to work with Xero, MYOB, QuickBooks, Reckon or your industry accounting software, and every team member signs a confidentiality agreement before starting work. Work is done during Australian business hours.
Two limits are worth stating. FreeMyCloud is not a registered tax or BAS agent and does not lodge: your bookkeeper prepares the figures and workpapers, and your registered agent lodges them. The saving, typically about 50% less than employing a bookkeeper locally, comes from where the work is done, not from cutting the controls in this article. See how outsourced bookkeeping works, the wider service on the offshore accounting and bookkeeping page, or the outsourced bookkeeping FAQs.
Want the access and confidentiality questions answered for your business?
A short call covers who would work on your file, what you sign, and how access works.
Or call 1300 66 88 14, or try the savings calculator. No lock-in contracts.
Frequently asked questions
What is APP 8 and when does it apply?
APP 8 is the cross-border disclosure principle in Schedule 1 of the Privacy Act 1988. APP 8.1 says that before an APP entity discloses personal information to a recipient who is not in Australia, and who is not the entity or the individual concerned, it must take such steps as are reasonable in the circumstances to ensure that recipient does not breach the Australian Privacy Principles, other than APP 1. It applies to your business, not to the overseas recipient.
Does the Privacy Act apply if my turnover is under $3 million?
Usually not. Section 6D(1) treats a business with annual turnover of $3,000,000 or less in the previous financial year as a small business, and small business operators generally fall outside the Australian Privacy Principles. Section 6D(4) overrides that for health service providers holding health information, businesses trading in personal information, Commonwealth contracted service providers and credit reporting bodies. Tax file number obligations apply whatever your turnover.
What counts as a notifiable data breach?
Under section 26WE(2) of the Privacy Act 1988, an eligible data breach occurs where there is unauthorised access to or unauthorised disclosure of information and a reasonable person would conclude it would be likely to result in serious harm to any affected individual. Information lost in circumstances where unauthorised access or disclosure is likely, and would likely cause serious harm, also counts. A suspected breach must be assessed within 30 days.
Does this apply to offshore accounting as well as bookkeeping?
Yes. The privacy rules turn on personal information being disclosed to a recipient outside Australia, not on what the work is called. Offshore accounting, bookkeeping, payroll processing and accounts payable work all raise the same APP 8 question if your business is an APP entity, and the same tax file number obligations once payroll data is involved. The practical controls, named user access and written confidentiality terms, are identical.
Is outsourcing to the Philippines different from outsourcing anywhere else?
Not as a matter of Australian law. APP 8.1 applies to any recipient outside Australia, and section 16C treats their acts as yours regardless of the country. What differs in practice is time zone overlap and the working arrangement. FreeMyCloud staff work during Australian business hours from an office in Manila, which is why questions can usually be answered the same day rather than overnight.
Do I need a confidentiality agreement with an offshore bookkeeper?
It is the normal way of showing the reasonable steps APP 8.1 asks for, and it is sensible even where your turnover puts you outside the Act. A workable agreement names the staff or role with access, states what the information may be used for, requires prompt notice of any suspected unauthorised access, and says what happens to data when the arrangement ends. FreeMyCloud signs one with every client.
This article is general information about Australian privacy and record handling obligations, current as at 30 October 2026. It is not tax, financial or legal advice. FreeMyCloud is not a registered tax agent and does not prepare or lodge tax returns. Rates, thresholds and dates change. Confirm your own position with your registered tax or BAS agent.
