Cross border data transfer clause

Sample clause

a customer support outsourcing agreement between Bilby Connect and Illawarra Solar Co, a fictional installer whose customer records include addresses and payment histories

11. Location of Customer Personal Information 11.1 Bilby Connect must not store, process, access or disclose Customer Personal Information outside Australia without Illawarra Solar's prior written consent. 11.2 If Illawarra Solar consents to a disclosure outside Australia, Bilby Connect must, before the disclosure: (a) identify in writing each overseas recipient, the country, and the purpose of the disclosure; (b) ensure each overseas recipient is bound by a written contract requiring it to handle the information in accordance with the Australian Privacy Principles, other than APP 1; and (c) give Illawarra Solar a copy of the relevant terms on request. 11.3 Access to Customer Personal Information by Bilby Connect's personnel while temporarily travelling overseas is a disclosure outside Australia for the purposes of this clause. 11.4 Bilby Connect is liable to Illawarra Solar for any act of an overseas recipient that would breach the Australian Privacy Principles if done by Bilby Connect.

Sample wording, not legal advice.

Variants

What to negotiate

• Storage versus access

  Suppliers often promise onshore storage while support staff overseas can view the same records. Customers now ask whether remote access counts, and increasingly insist that it does. Separating storage from access in the clause, with each location named, gives an accurate picture and lets the customer tell its own customers the truth in its privacy policy.

• Consent in advance or case by case

  A ban with consent required for each transfer gives the customer control but can stall a supplier that changes providers. A list of approved countries with notice and a right to object is easier to run. Customers with sensitive information usually keep case by case consent for anything outside the list.

• Who carries the risk of the overseas recipient

  Because APP 8 and section 16C can leave the Australian discloser accountable for what an overseas recipient does, customers want the supplier to bear that risk contractually. Suppliers accept liability for their own subcontractors but resist unlimited exposure, so this point usually ends up tied to the data protection sub cap in the liability clause.

The risk of leaving it out

Without the clause the supplier can move data to any country it chooses, and the customer may not find out until an incident. Under section 16C the customer can be treated as accountable for an overseas recipient's mishandling even though it never approved the transfer.

What APP 8 actually asks for

Before an entity covered by the Privacy Act discloses personal information to an overseas recipient, APP 8.1 requires it to take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles, other than APP 1. Section 16C then makes the entity accountable for acts of the overseas recipient that would breach the principles. There are exceptions, including where the recipient is subject to a law or binding scheme substantially similar to the principles that the individual can enforce, and where the individual consents after being expressly told that APP 8.1 will not apply. For most commercial arrangements, a contract binding the recipient to the principles is the practical reasonable step.

Disclosure or use

The OAIC guidelines distinguish a disclosure to an overseas recipient from a use, where the entity does not release the later handling of the information from its effective control. Providing information to an overseas cloud provider only to store it, under a binding contract that limits the provider to that purpose, may be a use rather than a disclosure, and APP 8 would then not apply. A support centre whose staff read and act on customer records looks very different. This is why the sample treats even temporary overseas access by the supplier's own personnel as a transfer for contract purposes: the contract can be stricter than the statute, and a clear rule avoids arguing about which category an arrangement falls into.

Where it sits in a generated document

A generated outsourcing agreement can hold this clause beside the data protection and security clauses, with approved countries set out in a schedule table. The generator writes every location as content, so the named countries should be confirmed with the supplier before signing. An attached supplier questionnaire gives the draft facts to work from, since research runs only when no file is attached.

Documents that carry this clause

UK data processing agreement template with sub-processorsA data processing agreement is what a UK controller has to have in writing before a processor touches personal data. This one covers a hosted order management platform for a UK retailer, with the processing annex, a table of five named sub-processors and their transfer safeguards, eight security measures, and a breach notice of 48 hours rather than 72.Privacy policy template written to the Australian Privacy PrinciplesA privacy policy is a list of true statements about what a business does with information, and copying a US template produces a list of false ones. This policy is written for an Australian online store to the thirteen privacy principles, with a table of every service that receives customer data and where it is, which is the part most policies skip.IT support services agreement with response times by priorityManaged support is sold on a monthly fee and judged on how fast the phone gets answered when nobody can work. This agreement grades every ticket into four priorities with a published response and resolution target, credits the fee when the target is missed, and writes down exactly what the provider hands back on the way out.

Questions people ask