---
title: "Cross-border disclosure of personal information under APP 8"
url: "https://ailawframework.com/precedents/privacy-data-protection-and-cyber/app-8-cross-border-disclosure"
type: "precedent"
site: "AI Law Framework"
id: "a25-app-8-cross-border-disclosure"
area_id: "A25"
kind: "checklist"
ai_level: "yellow"
version: 1
task_ids: ["A25-T1-R10"]
law_stated_as_at: "2026-10-22"
---

# Cross-border disclosure of personal information under APP 8

> Checklist, from the OAIC APP 8 chapter, of when a disclosure to an overseas recipient requires reasonable steps and when section 16C accountability applies.

Canonical page: https://ailawframework.com/precedents/privacy-data-protection-and-cyber/app-8-cross-border-disclosure  
Law stated as at: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

- Kind: Checklist. Steps or checks to work through and tick off.
- Practice area: [Privacy, Data Protection & Cyber](https://ailawframework.com/precedents/privacy-data-protection-and-cyber.md)
- Jurisdictions: Australia, Commonwealth
- AI level: Yellow. You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at: 2026-10-22
- Status: Maintained. Checked on 2026-10-22 against the authority it cites, for Australia and Commonwealth.

## When to use it

Use before an APP entity sends personal information to a person outside Australia who is not the entity itself. It does not decide that a proposed transfer is permitted.

## Used for these tasks

- [Build a cross-border transfer mechanism table](https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-a-cross-border-transfer-mechanism-table.md)

## How AI may be used

AI may record the recipient, the country and the contract clauses already on the file, and the lawyer decides whether APP 8 applies and whether an exception is made out.

**AI may:**

- Enter the recipient, the country and whether the recipient is a related body corporate, from the file
- List the contract clauses that address the APPs, subcontractors, complaints and data-breach notice
- Note which exception the instructing party asks the lawyer to consider, by the chapter's heading

**AI must not:**

- Must not decide that a disclosure is a use, or that reasonable steps have been taken
- Must not decide that a foreign law is substantially similar to the APPs
- Must not draft the overseas contract or a consent form

**The lawyer checks:**

- The recipient is an overseas recipient, and the dealing is a disclosure of personal information the entity holds
- APP 6 is also considered, as the chapter says APP 8 applies to personal information covered by APP 6
- Either reasonable steps under APP 8.1 are in place, or an exception in the chapter applies
- Section 95B is considered where an agency discloses to a contracted service provider

## Authorities

- [OAIC, APP Guidelines, Chapter 8: APP 8 Cross-border disclosure of personal information, updated 3 October 2025](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-8-app-8-cross-border-disclosure-of-personal-information)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/privacy-data-protection-and-cyber/app-8-cross-border-disclosure and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*