Most conversations about offshoring start with price and end with a question nobody in the room can answer with confidence: are we actually allowed to do this?
The short answer is yes. Australian accounting firms have sent preparation work overseas for years, and both the Office of the Australian Information Commissioner (OAIC) and the Tax Practitioners Board (TPB) have published guidance on how to do it properly. Neither regulator prohibits it. What both do is make the firm responsible for it — and that responsibility does not travel offshore with the work.
That distinction is the entire subject of this article. If you understand it before you send the first job, offshoring is an operational decision. If you discover it afterwards, it becomes a compliance problem with your name on it.
Sending work offshore is a “disclosure”, and that word carries weight
When personal information leaves Australia, Australian Privacy Principle 8 (APP 8) applies. Before disclosing personal information to an overseas recipient, an entity must take such steps as are reasonable in the circumstances to ensure the recipient does not breach the Australian Privacy Principles in relation to that information.
Firms frequently assume this does not apply to them, on the reasoning that the data never really leaves — the offshore team logs into the firm’s own Xero or Class file, so nothing has been handed over. It is an intuitive argument, and it does not hold.
The OAIC does draw a line between using information and disclosing it. Where an entity keeps such a degree of control that it is merely handling the information within its own effective control, that is a use, and APP 8 is not engaged. Routing data in transit through an overseas server is the textbook example. But engaging a contractor located overseas to perform services on your behalf is treated differently: in most circumstances, providing personal information to that contractor is a disclosure, and APP 8 must be satisfied before it happens.
The consequence is the part worth reading twice. Under section 16C of the Privacy Act 1988, a firm that discloses personal information to an overseas recipient is accountable for acts and practices of that recipient which would have breached the APPs. In practical terms, the firm wears the breach. A provider’s assurances are not a defence; the reasonable steps the firm took are.
The OAIC sets out what those steps look like, and the emphasis falls on enforceable contractual arrangements — specifying the purposes for which the recipient and any subcontractors may use the information, and the minimum technical and organisational security measures that apply to it. The detail is worth reading in full in the OAIC’s APP 8 guidelines on cross-border disclosure.
“We’re under the threshold” is a weaker position than it sounds
The Privacy Act’s small business exemption covers most organisations with an annual turnover of $3 million or less, and a large number of Australian practices sit comfortably under that line. Many conclude the Act is simply not their problem.
For an accounting firm, that conclusion is unsafe for a specific reason: tax file number recipients are covered regardless of turnover. The Privacy (Tax File Number) Rule 2015 regulates the handling of TFN information, and the Notifiable Data Breaches scheme applies to TFN recipients to the extent that TFN information is involved in a breach. A firm preparing individual returns handles TFNs by definition, which means the exemption does not clear the ground the way it first appears to.
The exemption can also be lost on other grounds — a business that trades in personal information, or one related to a larger business, is brought back in. And even a firm genuinely outside the Act is still bound by professional confidentiality under APES 110, by the TPB’s Code of Professional Conduct, and quite possibly by confidentiality terms in its own client engagements. The Privacy Act is one source of obligation here, not the only one.
What the Tax Practitioners Board expects
The TPB has dealt with this directly. Its current guidance is TPB(GS) 31/2018, Outsourcing and offshoring of tax services — renamed from a Practice Note to a Guidance Statement in April 2026, so firms working from an older internal policy may be citing a document that has since been archived. Two Code items do most of the work.
Code item 6 — confidentiality. A tax practitioner must not disclose information relating to a client’s affairs to a third party without the client’s permission or a legal duty to do so. Permission may be obtained through a signed letter of engagement, a signed consent, or other communication. The TPB’s recommendation is more specific than most engagement letters are: inform the client about the proposed disclosure, including to whom and where it will be made. The jurisdiction is part of the disclosure, not an operational detail to be kept in-house.
Code item 7 — competent services. A tax agent service provided on your behalf must be provided competently, and this expressly extends to services provided by an unregistered external contractor, whether in Australia or abroad. Supervision does not thin out because the preparer is in another country. The review layer is yours, and so is the outcome.
Read together, these put real pressure on the boilerplate clause. A line in your terms saying the firm “may engage third party service providers from time to time” is unlikely to amount to informed client permission for sending identified financial records to a named country.
Settle these before the first job leaves your office
None of this is difficult, but it is much easier to do before an engagement than to retrofit across a client base. A defensible arrangement generally has all of the following in place:
- The jurisdiction named in your engagement terms, not merely the fact that offshoring occurs.
- Client permission captured in writing, in a form you could produce on request, for each client whose information will be disclosed.
- A written agreement with the provider covering purpose limits, whether subcontracting is permitted, minimum security measures, breach notification timeframes, and return or deletion of data when the engagement ends.
- Access through your systems and your user accounts, with permissions you set, so that what offshore staff can reach is visible to you and revocable by you alone.
- No local copies — no removable drives, no personal email, no printing, no downloads to local machines.
- A named supervising practitioner responsible for review and sign-off on every job, recorded somewhere other than memory.
- A breach escalation path measured in hours, with a named contact on both sides, tested at least once before you need it.
- An offboarding step that actually happens on the day a staff member leaves, on either side of the arrangement.
A provider who cannot answer these questions in writing is telling you something useful about how the rest of the engagement will go.
Don’t build the arrangement on an exception
APP 8 has exceptions, and two get reached for often. The first applies where the entity reasonably believes the overseas recipient is subject to a law or binding scheme substantially similar to the APPs, and there are mechanisms the individual can access to enforce that protection. The second is the individual’s informed consent to the disclosure.
Both are narrower in practice than they look on paper:
- The Philippines has had a Data Privacy Act since 2012 and a National Privacy Commission to administer it. Whether that satisfies both limbs of the first exception — particularly accessible enforcement by your individual client — is a legal judgement for your own advisers to form on your facts. It is not something a provider can settle for you, and any provider asserting it flatly is overreaching.
- Consent must be genuinely informed and freely given. Consent bundled into terms that nobody reads invites precisely the argument you would least like to meet: that it was never informed at all.
The more durable posture is to assume APP 8.1 applies, take the reasonable steps, and treat the exceptions as a backstop rather than the design.
AML/CTF changed the picture in July 2026
From 1 July 2026, AML/CTF obligations were extended to tranche 2 entities, including accountants providing certain designated services. Newly regulated businesses were required to enrol with AUSTRAC — generally within 28 days of first providing a designated service, which for most meant 29 July 2026. The core obligations include developing and maintaining an AML/CTF program that identifies and manages the business’s risks, appointing a compliance officer, training staff, and being ready to identify and report suspicious activity.
This matters for offshoring because customer due diligence creates a new and unusually sensitive category of personal information: identity documents, source of funds and wealth, beneficial ownership details. If offshore staff touch client onboarding or document collection, that information now sits inside both your privacy obligations and your AML/CTF program — and the program has to describe how the arrangement is managed. A firm that mapped its offshore data flows for APP 8 a few years ago has a map that is now incomplete.
What a defensible arrangement looks like day to day
Everything above reduces to a fairly short operational picture. Offshore staff work inside the firm’s systems through the firm’s own user accounts, with permissions the firm controls and can withdraw in a minute. Nothing is stored locally, emailed personally or printed. Every person with access has signed a confidentiality agreement, and access is removed the day they leave. There is a written, rehearsed process for reporting a suspected breach that aligns with the Notifiable Data Breaches scheme. And every job carries a named reviewer at the firm, because supervision is the obligation that cannot be delegated offshore at all.
This is the standard we hold ourselves to, and the detail of how we do it is set out on our data security and confidentiality page. A firm evaluating any provider — us included — should ask for it in writing and read it against the checklist above.
A sensible place to start
Three steps, in order. Map the data: list what categories of client information would actually leave Australia for the work you have in mind, including anything collected for customer due diligence. Paper the arrangement: update engagement terms to name the jurisdiction, capture permission properly, and get a provider agreement that covers purpose, security, subcontracting, breach notification and exit. Pilot one job type, with full review, before extending it across the practice.
Firms that work through those three steps rarely find the compliance side difficult. The ones that run into trouble are almost always the ones that started with the second half of the conversation — capacity and cost — and left the first half until a client asked.
This article is general information about the obligations that apply to Australian firms, current as at October 2026, and is not legal, tax or compliance advice. Avior Offshore is not a registered tax agent or BAS agent and does not provide tax agent services, BAS services or financial advice. Confirm your own obligations with your professional body or legal adviser, and check the OAIC, TPB and AUSTRAC sources directly, as guidance is updated from time to time.