Every SaaS company selling into Australia eventually runs into this conversation. A prospect’s privacy team reads your SOC 2 report, seems happy with the security posture it describes, and then asks a different question: how are you handling APP 8?
If your compliance program was built around US and European buyers who ask for a SOC 2 report and move on, this can feel like a curveball. It is really a separate legal requirement, and assuming SOC 2 covers it tends to surface at the worst moment, during an Australian customer’s final legal review.
What APP 8 requires. Australian Privacy Principle 8 governs the cross-border disclosure of personal information under the Privacy Act 1988. Before an Australian business discloses personal information to a recipient outside Australia, it must take reasonable steps to make sure that recipient handles the information consistently with the Australian Privacy Principles. For most SaaS companies this happens constantly, through offshore cloud storage, CRM and marketing tools on US infrastructure, payment processors and AI tools on overseas servers.
Why accountability is the central idea. Under section 16C of the Privacy Act, if an overseas recipient does something that would have breached the APPs had the Australian business done it directly, the Australian business is treated as having breached the APPs itself. Accountability does not move to the vendor. So an Australian company cannot close the matter by pointing to a vendor’s privacy policy or SOC 2 report.
Where SOC 2 helps. A well-documented SOC 2 Type 2 report shows sustained operation of access controls, encryption and monitoring. That gives an Australian customer’s privacy team useful evidence for their own reasonable-steps assessment of you as a vendor. It supports the process, but it does not replace it.
Where SOC 2 falls short. Three things sit outside what a SOC 2 auditor examines. First, Data Processing Agreements with enforceable terms equivalent to the APPs. Second, privacy policy disclosure of overseas recipients and the countries data may be sent to. Third, the accountability chain itself, which stays with the Australian entity whatever the vendor’s controls look like.
The exceptions rarely apply cleanly. APP 8 has exceptions for informed consent, a reasonable belief that the recipient’s country has substantially similar protection, and recipients with an Australian link. Buried boilerplate does not count as informed consent, and the similar-protection test needs real analysis, so for most foreign SaaS vendors the reasonable-steps obligation is the working framework.
What to do in practice. Inventory every system that touches Australian personal information. Put Data Processing Agreements in place with your own overseas subprocessors. Name the categories of recipients and the countries in your privacy policy instead of using generic wording. And present your SOC 2 report as supporting evidence, stating clearly that your DPA and disclosure framework separately address APP 8.
Read the complete guide, including the FAQs:
https://accorppartners.com/blogs/soc-2/does-your-soc-2-report-actually-satisfy-australias-app-8-what-cross-border-data-rules-really-require
Top comments (0)