A Philippines-based VA is ready to help with customer appointments. The CRM contains everything from phone numbers to old finance attachments. Creating a login is easy; deciding which information the assistant should handle requires more thought.
Start with the work, the information involved and the actual arrangement between your business and the person or provider receiving access. A system hosted in Australia does not settle every question about overseas handling.
This checklist supports planning. Have a qualified adviser resolve uncertain Privacy Act coverage and cross-border obligations for your arrangement before opening live records.
Check which privacy obligations apply
First establish whether your business is an Australian Privacy Principles entity, commonly called an APP entity. Do not assume every business has identical obligations, or that a small team is automatically exempt.
The OAIC says most businesses with annual turnover of $3 million or less are not covered by the Privacy Act, but exceptions include health service providers, businesses trading in personal information and certain Commonwealth contractors. Related-business and voluntary opt-in arrangements can also matter. Use the OAIC's full checklist rather than turnover alone. OAIC: small business coverage.
Record who assessed coverage, the basis and when it should be reviewed. Separately check customer contracts and any sector-specific requirements. A conclusion about the APPs is not permission to ignore other applicable obligations or commitments.
Map the information before choosing permissions
List the information the VA will encounter, why it is needed, where it is stored and what happens after access. Include attachments, search results, exports, connected applications and copied messages, not just the visible customer form.
For a fictional appointment coordinator, Mia, the initial map might look like this:
| Information | Purpose in this role | Proposed boundary |
|---|---|---|
| Customer name and contact channel | Confirm an assigned appointment | Only the assigned appointment queue |
| Service address and agreed time | Check booking details | Relevant jobs and current instructions |
| Finance and identity attachments | No routine scheduling purpose | Kept outside Mia's accessible records |
| Free-text notes | Find necessary appointment instructions | Review unnecessary detail and restrict unrelated material |
This is a proposed workflow, not a universal permission template. Test whether your CRM can enforce it across attachments and search. If it cannot, redesign the queue with the system owner before expanding access.
Our CRM cleanup guide covers improving the underlying records. Accurate records still need an appropriate handling plan.
Assess whether overseas access is use or disclosure
The distinction depends on effective control. The OAIC describes use as handling information within an entity's effective control, and disclosure as making it available outside the entity while releasing control over its subsequent handling.
Providing information to an overseas contractor is a disclosure in most circumstances. Limited arrangements may instead be a use when effective control remains with the Australian entity. Calling someone “our team” or preventing downloads does not, by itself, determine the answer. OAIC: sending personal information overseas.
Give your adviser the actual contract, recipient identities, onward-access arrangements and technical controls. Explain whether information can enter another provider's systems and how your business can retrieve or remove copies.
If the arrangement is a use, APP 8 may not apply, but obligations attached to information the entity still holds can remain. Treat classification as an assessment of the facts, not a route around privacy responsibilities.
Understand accountability before relying on an exception
Where APP 8.1 applies, the Australian entity must take reasonable steps before disclosure to ensure the overseas recipient does not breach the APPs other than APP 1.
Section 16C can make the Australian entity accountable for a recipient's act that would breach the APPs other than APP 1 if they applied. This requires APP 8.1 to apply and the recipient not to be bound by the APPs for that information. Taking reasonable steps does not automatically remove this accountability.
Exceptions have conditions. For example, relying on substantially similar overseas protection requires a reasonable belief about both that protection and the individual's ability to enforce it. A country having a privacy law is insufficient by itself.
The APP 8.2(b) consent exception requires expressly explaining that APP 8.1 will not apply, including the consequences for accountability and redress, then obtaining valid consent. Generic privacy-policy acceptance should not be treated as satisfying that test. Other exceptions exist; obtain advice on the specific basis rather than assuming a confidentiality agreement removes responsibility. OAIC: APP 8 guidance.
Put the handling rules into the workflow
Agree the permitted purpose, approved storage, onward-access restrictions and incident contact with the person or provider. Confirm how the arrangements work in practice, including any subcontractors and copies outside the CRM.
APP 6 generally limits an APP entity's use or disclosure to the purpose of collection unless an exception applies. Assess a proposed new use separately. OAIC: APP 6 guidance.
For an APP entity, APP 11 requires reasonable security steps, including technical and organisational measures. Appropriate controls depend on the circumstances. OAIC: APP 11 guidance.
Use named accounts, suitable access limits, approved devices and training. Our secure offshore onboarding guide covers account setup and removal.
Practise an exception with fictional records: Mia encounters an unrelated attachment in an appointment record. She reports its location to the designated owner without copying it into a team chat. The owner checks access scope and handles remediation.
Give the VA a route for customer access or correction requests and suspected incidents. Log operational facts without creating another unnecessary collection of customer information.
Keep notices, retention and scope current
For APP entities, privacy policies must explain likely overseas disclosures and identify recipient countries where practicable. Collection notices involve separate reasonable-step obligations about likely overseas disclosures. Review both against the actual workflow. OAIC: APP 1, OAIC: APP 5.
Reassess when duties, providers, countries or connected tools change. A newly enabled transcription or AI service can change the information path even when Mia's job title stays the same.
Set retention responsibilities for exports, notes and attachments. Under APP 11, information no longer needed for a permitted purpose generally requires reasonable steps to destroy or de-identify it, subject to exceptions including retention required by Australian law or a court or tribunal order, and Commonwealth records. Apply that assessment to copies as well as the main CRM.
Talk to Nexus about planning VA support with a defined customer workflow, information map and responsible business owner.
