Data Sovereignty in Australia: Why Offshoring Clauses Fail

Most supplier contracts in Australia now include a clause that says something like “data must not leave Australia without our written approval”. It reads well in a tender and it ticks a box in a security questionnaire. The federal courts have just shown, twice, how little that clause is worth if nobody checks it.

Tilt-shift miniature of a courthouse forecourt with a courier van loading sealed archive boxes and a cargo plane taxiing on a runway in the background — The courts’ transcription contract required approval before information left Australia. The offshoring came to light only after a former manager reported it.

What happened

The ABC reported on 16 October 2026 that the federal courts were told in December 2014 that their transcription contractor, Auscript, was running a pilot in India. The contract required Auscript not to transfer information outside Australia without the court’s prior approval. That approval was never sought.

A former Auscript manager raised it with the courts and the Australian Federal Police in 2014.
Auscript later admitted to a pilot of about seven months, saying the audio was encrypted and deleted within 48 hours.
In 2016 the family court described the failure to notify it as a “technical, minor and inconsequential breach”, and told the whistleblower the contract had no express provision preventing offshore work.
Earlier in 2026, the ABC reported that the successor contractor, VIQ Solutions, had also allowed sensitive court files to be accessed in India, in breach of its Commonwealth contract. VIQ collapsed shortly after and is winding down.
The court’s current leadership says it was unaware of the earlier offshoring until the ABC asked. The Opposition has called for a forensic audit, and the Greens for an independent inquiry.

Two contractors, the same contract chain, and the same breach a decade apart. The clause was there both times. What was missing was anyone checking that it was being followed.

Short answer

A no-offshoring clause is a control on paper. It only protects you if you can show, with evidence, where your data is actually processed, by whom, and that any change is approved before it happens. ISO 27001 asks for both halves: the requirement in the agreement (control A.5.20) and ongoing monitoring of the supplier’s service (A.5.22). Under the Privacy Act, if you disclose personal information to someone overseas, you generally remain accountable for what they do with it (APP 8 and section 16C).

Why “data sovereignty” is a supplier problem

Data sovereignty is usually discussed as a cloud question: which region is the server in? For most small and mid-sized businesses, the bigger exposure is people, not servers. Your data leaves the country when:

a transcription, bookkeeping or virtual assistant service routes work to an offshore team
a managed service provider’s after-hours helpdesk is based overseas and has remote access
an offshore development team works on a copy of production data
a supplier quietly adds a subcontractor, who adds another
a SaaS vendor’s support staff can view your records from another country

None of these shows up in a data-residency setting. They show up only if you ask, and keep asking.

What ISO 27001 expects

Control	What it asks	What that looks like in practice
A.5.19 Information security in supplier relationships	Identify and manage the risks of suppliers accessing your information	A supplier register that records what data each supplier handles and where
A.5.20 Addressing information security within supplier agreements	Put the requirements in the contract	Data location, approval before any change of location, subcontractor approval, right to audit, breach notification timeframes
A.5.21 Managing information security in the ICT supply chain	Extend requirements down the chain	The supplier must flow your requirements to its own subcontractors and tell you who they are
A.5.22 Monitoring, review and change management of supplier services	Check that the supplier is doing what it agreed	Periodic evidence requests, use of the audit right, review of changes to how the service is delivered

Most organisations do a reasonable job of A.5.20. The contract has the clause. A.5.22 is where it falls over, and it is exactly where the courts’ arrangement failed.

What APP 8 adds

If your business is covered by the Privacy Act and you disclose personal information to an overseas recipient, APP 8 requires you to take reasonable steps to ensure the recipient handles it in line with the Australian Privacy Principles. Under section 16C, if the overseas recipient then mishandles it, your business can be held accountable as if it had done so itself.

Disclosure includes a supplier’s offshore staff accessing the information to provide the service. “We didn’t know our supplier was doing that” is not a defence. It is evidence that the reasonable steps were not taken. Our article on the OAIC’s Qantas decision covers what the regulator treats as reasonable.

Five questions to ask your suppliers this month

Where is our data stored, processed and accessed from? All three, not just where the server sits. Ask for a list of countries, including support and helpdesk.
Who are your subcontractors for this service? Get names, and what each one does with your data.
What happens if that changes? The contract should require your approval before any change of location or subcontractor, not a notice afterwards.
How will you show us? An annual attestation, a current ISO 27001 certificate with a scope that covers the service, a SOC 2 report, or an audit you carry out.
When did we last check? If the answer is “at onboarding”, the control is not working.

Record the answers against each supplier in your supplier register, set a review date, and treat a surprise answer as a nonconformity with a corrective action.

Signs the control exists only on paper

The offshoring clause is in the contract, but nobody in the business could tell you which suppliers it applies to.
Supplier reviews happen at onboarding and never again.
The audit right has never been used.
Nobody has asked a supplier for evidence in the last 12 months.
A supplier’s staff left or changed, and nobody re-checked access.
When something goes wrong, the first question is “what does the contract say?” rather than “what did we check?”

How an internal audit tests this

An internal audit of supplier management should sample suppliers that handle sensitive information and ask to see the evidence: the contract clause, the most recent review, the supplier’s answer on data location, and what was done when something changed. If the records stop at the signed contract, the auditor has found the same gap the courts had. For more on what happens when the supplier is the one breached, see Your Supplier Lost the Data. The Notification Is Still Yours.

Data sovereignty: FAQs

What does data sovereignty mean in Australia?

It means data about Australians, or held by Australian organisations, is subject to Australian law and controls. In practice it covers where data is stored, where it is processed and who can access it, including suppliers and their staff overseas.

Is it illegal to send personal information overseas?

Not in itself. APP 8 allows overseas disclosure, but generally requires you to take reasonable steps to make sure the recipient handles it properly, and you can remain accountable if it does not. Some contracts, government work and sectors add stricter onshore requirements.

Does a no-offshoring clause make us compliant?

No. It is a requirement. Compliance comes from monitoring it: asking for evidence, using audit rights and acting when something changes.

Which ISO 27001 controls cover offshoring by suppliers?

Mainly A.5.19 to A.5.22, covering supplier relationships, supplier agreements, the ICT supply chain and monitoring of supplier services. A.5.23 adds requirements for cloud services.

How often should we review suppliers?

Base it on risk. Suppliers handling sensitive or personal information should be reviewed at least annually and whenever the service changes.

How Streamline can help

Streamline builds and audits ISO 27001 information security management systems for Australian organisations, including supplier registers and review processes that hold up at audit. You deal directly with an experienced ISO Lead Auditor. ISO mentoring helps your own people run the system. If you would like a hand, get in touch.

Sources

Published 18 October 2026 | Facts checked 18 October 2026 | Next review April 2027, or when the Privacy Act tranche 2 reforms pass | Jurisdiction: Australia | Edition: ISO/IEC 27001:2022, Privacy Act 1988 (APP 8)

General guidance only. This article is general information, not legal, financial, safety or compliance advice, and it does not take account of your specific circumstances. Streamline ISO Consultants are ISO management-system consultants, not lawyers or licensed advisers. Standards, laws and regulator guidance change, and details were correct only at the time of writing. Always seek professional advice before acting. See our full Disclaimer.