Corpshore Australia sets out its approach to Privacy Act 1988 and New Zealand Privacy Act 2020 compliance for outsourcing clients

Corpshore Solutions Corporation has published a statement of how it approaches compliance with the Privacy Act 1988 (Cth) and the New Zealand Privacy Act 2020 when handling personal information on behalf of outsourcing clients, ahead of engagements that involve disclosing that information to a delivery team outside Australia or New Zealand.

Under the Australian regime, Australian Privacy Principle 8 and section 16C of the Privacy Act 1988 require an Australian entity, before disclosing personal information to an overseas recipient, to take reasonable steps to ensure that recipient does not breach the Australian Privacy Principles. Accountability does not transfer with the data: if the overseas recipient breaches a principle, the disclosing Australian entity is treated under the Act as if it had breached that principle itself, subject to limited exceptions such as informed consent or the recipient being subject to a substantially similar law with its own enforcement mechanisms. Corpshore's engagement model is built around that retained accountability, meaning contractual and operational undertakings are structured to support the Australian client's own compliance position rather than to imply the obligation has moved with the work.

New Zealand's framework differs in one respect that matters to how an engagement is structured. Under the Privacy Act 2020's information privacy principle 12, data sent overseas purely for safe custody or processing on an agency's behalf, where the offshore provider does not use the data for its own purposes, is not treated as a "disclosure" at all, a materially more permissive position than Australia's. Corpshore Australia structures New Zealand engagements to fit within that service-provider position where it genuinely applies, and does not rely on it where an engagement's actual data use falls outside it.

Corpshore describes its own compliance posture for both frameworks as "aligned," a deliberate choice of word. It means practices are designed around the requirements of the Privacy Act 1988, the Australian Privacy Principles and the Privacy Act 2020, not that Corpshore has been independently certified or audited against them. Corpshore has not represented its privacy posture as certified or audited under either statute, and does not intend to until that claim is genuinely earned.

"Privacy law is one of the few places where a marketing shortcut becomes somebody else's legal exposure, so we do not take it," said Frank B. Prempeh II, Founder and Chief Executive Officer of Corpshore Solutions Corporation. "'Aligned with' is a weaker sentence than 'certified' and we use it anyway, because it is the true one."

Further detail on Corpshore's compliance approach for Australian and New Zealand clients is available at corpshoreaustralia.com/about/compliance-and-security.