IT Offshoring Agreement Lawyers Adelaide: Cross-Border Data, Governing Law, Code and Staff
IT offshoring agreements in South Australia
Sending development, support or back-office IT work overseas can cut costs, but it also sends personal information, source code and legal risk across a border. Talon Legal advises Adelaide businesses that offshore IT work, and overseas providers serving Australian clients, on agreements that deal with the border rather than ignore it. Book a same-day free 30-minute consultation or call (08) 7094 2021.
IT offshoring agreement key facts
| Issue | Position in South Australia |
|---|---|
| Cross-border disclosure | Before disclosing personal information to an overseas recipient, an APP entity must take reasonable steps so the recipient does not breach the APPs (APP 8.1). |
| Liability for the provider | If the overseas recipient does something that would breach the APPs, the act is treated as the Australian entity's breach (Privacy Act section 16C). |
| Overseas contractors | The Information Commissioner's APP guidelines treat giving personal information to an overseas contractor as a disclosure in most cases. |
| Exceptions | A reasonable belief that the recipient is bound by substantially similar, enforceable protections; express notice and consent; disclosures required or authorised by Australian law (APP 8.2(a) to (c)). |
| Provider bound directly | The Privacy Act extends to acts outside Australia by an organisation that carries on business in Australia (section 5B(1A) and (3)). |
| Foreign governing law | The consumer guarantees apply despite a term substituting foreign law (ACL section 67; Valve v ACCC at [103]). |
| Arbitration | Australian courts must stay proceedings brought in breach of a covered arbitration agreement (International Arbitration Act 1974 section 7(2)), and foreign awards are enforceable here (section 8). |
| Code ownership | Copyright belongs to the author unless the author is an employee under a contract of service (Copyright Act section 35(6)). An assignment has no effect unless in writing and signed by the assignor (section 196(3)). |
| Confidential information | Information identified with specificity, with the necessary quality of confidence, received in confidence, and misused without consent (Optus Networks v Telstra at [39]). |
| Australian staff | A dismissal is a genuine redundancy only if the job is no longer required and consultation obligations are met, and not if redeployment was reasonable (Fair Work Act section 389). |
| Mass redundancies | A decision to dismiss 15 or more employees for economic, technological, structural or similar reasons must be notified to Centrelink before any dismissal (section 530). |
| First step | Same-day free 30-minute consultation. Call (08) 7094 2021. |
Need an IT offshoring agreement lawyer in Adelaide?
Our IT offshoring agreement lawyers in Adelaide act for South Australian businesses that send software development, testing, support or back-office IT work overseas, and for offshore providers contracting with Australian clients. An offshoring agreement raises every question a local outsourcing deal does, plus cross-border privacy rules, a foreign legal system and the practical problem of enforcing the contract. The Privacy Act 1988 (Cth) and the Australian Consumer Law (ACL) in the Competition and Consumer Act 2010 (Cth) bear on it. So do the Copyright Act 1968 (Cth), the International Arbitration Act 1974 (Cth) and the Fair Work Act 2009 (Cth). This page states the law current to 24 October 2026.
This guide is part of our IT outsourcing, cloud and hosting practice. Related guides cover software development agreements, cloud services agreements, BPO and call centre agreements and data protection and privacy.
For an offshore supplier’s security and breach notice terms, see our guide to data security clauses.
Free Consultation. Send us the provider’s proposal or draft agreement before work or data moves offshore. Book a same-day free 30-minute consultation or call (08) 7094 2021.
On this page
- What makes an offshoring agreement different?
- What must a business do before sending personal information overseas?
- Does the Privacy Act bind the offshore provider?
- Which law governs, and where are disputes decided?
- Who owns code written offshore?
- How should source code and confidential information be protected?
- How should quality and security be managed across a border?
- What happens to Australian staff when work goes offshore?
- How should exit be planned?
- How similar matters tend to play out
- How we act on offshoring agreements
- Case law
- Frequently asked questions
What makes an offshoring agreement different?
The border. The provider’s staff work under another country’s laws, and the personal information they handle is subject to Australian cross-border rules. If the relationship fails, suing the provider may mean litigating or enforcing overseas. An offshoring agreement has to deal with each of those deliberately.
Distance also changes how the work is managed. Oversight that happens naturally with a local team, such as walking past a desk or attending a meeting, has to be written into the agreement as reporting, audit rights and governance meetings. Payment terms carry more weight too, because withholding payment is often the customer’s main practical remedy against a provider with no assets in Australia.
An IT offshoring agreement lawyer will also look at the Australian end: the customer’s own staff whose work is moving, and the obligations the customer keeps for data it sends away.
What must a business do before sending personal information overseas?
Take reasonable steps first. An APP entity may be about to disclose personal information to an overseas recipient. It must first take such steps as are reasonable in the circumstances so that the recipient does not breach the APPs, other than APP 1 (APP 8.1). In practice that means due diligence on the provider and a contract that binds it to handle the information as the APPs require, with audit rights and incident notice.
The Australian entity then answers for the provider. Suppose APP 8.1 applies and the overseas recipient does something that would breach the APPs. The act is then taken to have been done by the Australian entity, and to be its breach (Privacy Act section 16C). A provider’s mishandling of customer records becomes the customer’s interference with privacy.
The Information Commissioner’s APP guidelines say that engaging an overseas contractor to perform services is, in most circumstances, a disclosure. Offshore developers or support staff who can see production data containing personal information will usually fall within APP 8. Keeping personal information out of offshore development and test environments, by using de-identified or synthetic data, is often the simplest control.
There are exceptions. APP 8.1 does not apply where the entity reasonably believes the recipient is subject to a law or binding scheme at least substantially similar overall to the APPs. Individuals must be able to access mechanisms to enforce it (APP 8.2(a)). It also does not apply where individuals are expressly told that APP 8.1 will not apply if they consent, and they then consent (APP 8.2(b)). Nor does it apply where the disclosure is required or authorised by Australian law or a court or tribunal order (APP 8.2(c)). A further exception covers countries and schemes prescribed by regulation (APP 8.2(aa) and 8.3); the current regulations should be checked before relying on it.
Does the Privacy Act bind the offshore provider?
It can. The Privacy Act extends to acts and practices outside Australia by an organisation with an Australian link (section 5B(1A)). An Australian link includes Australian citizens and companies incorporated in Australia (section 5B(2)). It also includes an organisation that carries on business in Australia (section 5B(3)).
An offshore provider with an Australian subsidiary, office or sales operation may therefore be directly bound. That does not relieve the Australian customer. Its own obligations under APP 8.1, APP 11 and section 16C remain, so the contract still needs to carry the privacy terms.
Which law governs, and where are disputes decided?
Whatever the contract says, within limits. Parties can choose the law that governs their contract and the courts or arbitral tribunal that decide disputes. An Australian customer will usually want South Australian law and South Australian courts, and an offshore provider will usually want its own.
Some Australian law applies regardless of the choice. Where a consumer is involved, the consumer guarantees apply despite a term that purports to substitute the law of another country (ACL section 67). In Valve Corporation v ACCC [2017] FCAFC 224, the Full Court rejected the argument that the guarantees did not apply because the contract’s proper law was foreign ([103]). It described the evident purpose of section 64 as preventing parties from contracting out of the guarantees ([107]).
The harder question is enforcement. A judgment from an Australian court may be of little use against a provider whose assets are all overseas, and whether it can be enforced in the provider’s country depends on that country’s law. That is why many offshoring agreements use international arbitration.
The International Arbitration Act gives effect in Australia to the 1958 New York Convention on the recognition and enforcement of foreign arbitral awards (section 3(1) and Schedule 1). Sometimes a party to a covered arbitration agreement sues in an Australian court on a matter the agreement sends to arbitration. On application, the court must stay the proceedings and refer the parties to arbitration (section 7(2)). A foreign award is binding on the parties and can be enforced in a State, Territory or Federal Court as if it were a judgment of that court (section 8(1) to (3)). Whether an award can be enforced in the provider’s country depends on that country’s law, and should be checked before the clause is agreed.
Practical protections often matter more than the dispute clause. Milestone payments, retentions, source code escrow, a local parent company guarantee and a right to take over the work at short notice all reduce how much the customer needs a court at all.
Who owns code written offshore?
Whoever the contract and copyright law say, and without a written assignment that is usually not the customer. Under the Copyright Act, the author of a literary work, which includes a computer program, owns the copyright (sections 10(1) and 35(2)). The main exception is a work made by an employee under a contract of service, which belongs to the employer (section 35(6)).
An offshore developer is not the customer’s employee. An assignment of copyright has no effect unless it is in writing and signed by or on behalf of the assignor (section 196(3)). An agreement signed before the code exists can assign copyright in it, which then vests in the customer as the code is created (section 197(1)).
The agreement should therefore contain a present assignment of future copyright from the provider, and a promise that the provider has secured the rights of its own personnel and subcontractors. Who owns work created by a provider’s staff under the provider’s local law is a question for that law, which is why the provider’s promise matters. The software development agreements guide covers acceptance testing, open source and AI coding tools.
How should source code and confidential information be protected?
By contract and by design. Confidentiality obligations in the agreement should identify what is confidential, limit use to the project, bind the provider’s staff and subcontractors, and require return or destruction at the end.
Equity protects confidential information alongside the contract. In Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21, the Full Court set out the elements of a breach of confidence. The information must be identified with specificity, have the necessary quality of confidence, have been received in circumstances importing an obligation of confidence, and be misused, or threatened to be misused, without consent ([39]).
The same case held that an exhaustive contractual definition of confidential information did not, by itself, exclude the equitable obligations ([29]). The parties could agree that a party alleging misuse may choose between damages for breach of contract and an account of profits ([37]). An agreement that preserves both routes gives the customer more options if code or data is misused.
Design does the rest. Repository access limited to what each developer needs, logging, no production data in development environments, and keys held by the customer reduce what can leak in the first place.
How should quality and security be managed across a border?
Through measurable service levels, reporting and audit rights. Service levels should define what is measured and the consequence of missing it. Service credits are fixed sums triggered by failure. In Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28, Kiefel J, with French CJ agreeing, asked whether such a sum is out of all proportion to the interests the provision protects ([29]). The appellants did not establish that the bank’s late payment fee was a penalty ([69]).
Security deserves the same precision. A customer covered by the Privacy Act must take reasonable steps to protect personal information it holds (APP 11.1). In Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224, overreliance on third party service providers was one reason the company had not taken reasonable steps ([52]). Its reliance on a provider’s assessment that monitored only 3 of at least 127 affected computers was unreasonable, because it knew the assessment was limited ([77] to [78]).
The agreement should set a security standard, require prompt incident notice and give the customer access to logs and personnel. The customer must assess a suspected eligible data breach within 30 days (section 26WH), wherever the provider is.
Liability caps are read for what they say. Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82 came to the High Court from South Australia. A limitation clause is construed according to its natural and ordinary meaning, in light of the contract as a whole. Where appropriate, an ambiguous clause is read against the party relying on it ([16]). A customer whose regulatory exposure is large should negotiate caps that carve out privacy and confidentiality breaches.
What happens to Australian staff when work goes offshore?
Usually redundancy, which has its own rules. A dismissal is a case of genuine redundancy only if the employer no longer requires anyone to perform the job, because of changes in the operational requirements of its enterprise (Fair Work Act section 389(1)(a)). The employer must also have complied with any obligation in an applicable modern award or enterprise agreement to consult about the redundancy (section 389(1)(b)).
Redeployment must be considered. A dismissal is not a genuine redundancy if it would have been reasonable in all the circumstances to redeploy the person within the employer’s enterprise, or that of an associated entity (section 389(2)). That matters because a person has been unfairly dismissed only if, among other things, the dismissal was not a case of genuine redundancy (section 385(d)).
Larger moves trigger notice duties. An employer may decide to dismiss 15 or more employees for reasons of an economic, technological, structural or similar nature. It must then give written notice to Centrelink as soon as practicable after the decision, and before dismissing anyone (section 530(1) and (3)). It may also need to notify and consult the relevant registered employee associations (section 531).
The transfer of business rules apply only where a departing employee is employed by the new employer within three months to do the same or substantially the same work (section 311(1)). Where the work moves to staff overseas and the Australian employees are not taken on, the questions are redundancy and notice, not transfer.
How should exit be planned?
Before the work moves. The agreement should require knowledge transfer, handover of code, documentation and credentials, a transition period during which the provider keeps working, and return and deletion of data.
Deletion is a legal obligation as well as a contractual one. An APP entity that no longer needs personal information for any permitted purpose, and is not required by law to keep it, must take reasonable steps to destroy or de-identify it (APP 11.2). Because the customer answers for the overseas recipient under section 16C, confirmation of deletion by the provider is worth requiring in writing.
A customer bringing work back in house, or moving it to another provider, also needs the source code, build tools and access to third party accounts in its own name. Those should be in the customer’s name from the start.
How similar matters tend to play out
Three illustrations of how the law on this page combines on ordinary facts. They are not predictions. Outcome depends on the contract, the evidence and the court.
Lower range. An Adelaide software company engages an overseas development team through a freelancing platform, on the platform’s terms, which say nothing useful about ownership. When an investor asks who owns the code, the answer under Australian law is that copyright did not pass without a signed written assignment (section 196(3)). A deed of assignment from each developer, obtained before the investment closes, is the usual fix.
Middle range. A financial planning business with turnover over $3,000,000 moves its client support desk offshore, and the provider’s staff can see client records. That is likely a disclosure, so the business must take reasonable steps before disclosing (APP 8.1). If the provider mishandles the records, the act is treated as the business’s own breach (section 16C). Contract terms, audits and limited access are the controls.
Upper range. A company with 120 employees decides to move the work of its 30-person IT team to an offshore provider. It must notify Centrelink before any dismissal (section 530), consult as its enterprise agreement or award requires (section 389(1)(b)), and consider redeployment within the business (section 389(2)). Data migration, code handover and the provider’s security standard need settling before the first developer leaves.
How we act on offshoring agreements
We act for Australian customers and for offshore providers. For a customer, the aim is a provider bound to Australian privacy standards, code it owns, payment terms that keep leverage, a dispute clause it can use, and a lawful process for its own staff. For a provider, it is terms an Australian client will sign and a clear line around what it answers for.
| Stage | What happens | What we do |
|---|---|---|
| Planning | The business decides what work, data and staff are affected. | Map personal information flows, APP 8 position and the staff process. |
| Due diligence | The provider and its location are assessed. | Review the provider's terms, security, subcontractors and Australian presence. |
| Drafting | The offshoring agreement is prepared or negotiated. | Draft privacy, IP assignment, confidentiality, service level, dispute and exit terms. |
| Staff | Australian roles are changed or made redundant. | Advise on consultation, redeployment, Centrelink notice and transfer of business. |
| Operation | Quality, security or payment disputes arise. | Advise on service credits, withholding, incidents and breach assessment. |
| Exit | Work comes back or moves to another provider. | Enforce knowledge transfer, code handover and deletion. |
We cannot promise an outcome, and no lawyer can. We can make sure the agreement deals with the border before it becomes the problem.
Every hour matters. Book a same-day free 30-minute consultation, or call (08) 7094 2021 now.
IT offshoring case law
Valve concerned an overseas supplier and a foreign governing law. The other decisions deal with the confidentiality, data security, penalty and construction points that every offshoring agreement raises.
| Case | Court | Principle | Pinpoint |
|---|---|---|---|
| Valve Corporation v ACCC [2017] FCAFC 224 | Full Federal Court | Guarantees apply despite a foreign proper law; no contracting out | [103], [107] |
| Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21 | Full Federal Court | Elements of breach of confidence; contract and equity side by side | [29], [37], [39] |
| Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224 | Federal Court | Overreliance on providers; inadequate provider assessment | [52], [77], [78] |
| Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28 | High Court | When a sum payable on default is a penalty | [29], [69] |
| Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82 | High Court | How exclusion and limitation clauses are construed | [16] |
Case notes
Valve Corporation v ACCC [2017] FCAFC 224
The Full Court rejected the argument that the consumer guarantees did not apply because the contract’s proper law was foreign ([103]), and said the evident purpose of section 64 is that parties cannot contract out of the guarantees ([107]).
Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21
The Full Court held that an exhaustive contractual definition of confidential information did not exclude equitable obligations of confidence ([29]), that the parties could agree a party alleging misuse may elect between contract damages and an account of profits ([37]), and set out the four elements of breach of confidence in equity ([39]).
Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224
The company had not taken reasonable steps to protect personal information, in part because of its overreliance on third party service providers ([52]). Its reliance on an external provider’s assessment that monitored 3 of at least 127 affected computers was unreasonable, because it knew the assessment was limited ([77] to [78]).
Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28
Kiefel J, with French CJ agreeing, asked whether a sum payable on default is out of all proportion to the interests the provision protects ([29]). The appellants did not establish that the late payment fee was a penalty ([69]).
Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82
On appeal from South Australia, the High Court held that exclusion and limitation clauses are construed according to their natural and ordinary meaning, in light of the contract as a whole, and where appropriate against the party relying on them in case of ambiguity ([16]).
Frequently asked questions
Can a business send customer data offshore?
Yes, with conditions. Before disclosing personal information to an overseas recipient, it must take reasonable steps so the recipient does not breach the APPs (APP 8.1), unless an exception applies. It can be liable for what the recipient does (section 16C).
Is giving an offshore developer system access a disclosure?
Usually, if the developer can see personal information. The Information Commissioner’s APP guidelines treat giving personal information to an overseas contractor as a disclosure in most cases. Using de-identified data in development avoids the question.
Is an offshore provider bound by the Privacy Act?
It can be. The Act extends to acts outside Australia by an organisation that carries on business in Australia (section 5B(1A) and (3)). The Australian customer’s own obligations remain.
Which law should govern an offshoring agreement?
Usually the law of the place where the customer can most readily enforce it. Some Australian law applies regardless, such as the consumer guarantees where a consumer is involved (ACL section 67; Valve v ACCC at [103]).
Should an offshoring agreement use arbitration?
Often. An Australian court must stay proceedings brought in breach of a covered arbitration agreement (International Arbitration Act section 7(2)), and foreign awards are enforceable in Australia (section 8). Whether an award is enforceable in the provider’s country depends on that country’s law.
Who owns code written by an offshore developer?
The developer or its employer, unless copyright is assigned in writing and signed by the assignor (Copyright Act section 196(3)). An agreement signed before the code exists can assign it as it is created (section 197(1)).
How can source code be protected when work is offshored?
Through confidentiality terms, limited repository access, escrow and keeping production data out of development. Equity also protects confidential information that is identified with specificity and misused without consent (Optus Networks v Telstra at [39]).
Are service credits from an offshore provider enforceable?
Generally, if they are not out of all proportion to the interests they protect (Paciocco v ANZ, Kiefel J at [29]). Collecting them depends on the payment terms, which is why credits are usually set off against fees.
What must a business do for staff whose work is offshored?
Follow a lawful redundancy process. A dismissal is a genuine redundancy only if the job is no longer required and consultation obligations are met, and not if redeployment was reasonable (Fair Work Act section 389).
Must Centrelink be notified when work is offshored?
If the business decides to dismiss 15 or more employees for economic, technological, structural or similar reasons. Written notice must be given as soon as practicable after the decision and before any dismissal (section 530).
Who is responsible if the offshore provider has a data breach?
The Australian customer remains responsible for the personal information it holds (APP 11.1), and where APP 8.1 applied it can be liable for the provider’s acts (section 16C). It must assess a suspected eligible data breach within 30 days (section 26WH).
Do I need an IT offshoring agreement lawyer?
For any offshoring that involves personal information, code or Australian staff, yes. An IT offshoring agreement lawyer can settle privacy, ownership, disputes and the staff process before work moves. A free 30-minute consultation will tell you where you stand.