Under Australian Privacy Principle 8, an Australian company that discloses personal information to a recipient in India must first take reasonable steps to ensure the recipient handles it in line with the APPs, and under section 16C of the Privacy Act 1988 it remains accountable if the Indian recipient gets it wrong. India has not been prescribed as having substantially similar protection, so the safeguards come from contracts, access controls and oversight. Some data has stricter limits, such as tax file numbers and My Health Record information, which cannot be held outside Australia. In India, the DPDP Act, 2023 applies fully to data of people in India, but Australian residents' data processed under a contract with the Australian company is largely exempt.
← Back to the complete guide: How to Set Up a Subsidiary in India from Australia
Key facts
| Australian law | Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs) |
|---|---|
| Regulator | Office of the Australian Information Commissioner (OAIC) |
| Cross-border rule | APP 8, with accountability under section 16C |
| India's status | Not prescribed as having substantially similar protection |
| Recent reform | Privacy and Other Legislation Amendment Act 2024: statutory privacy tort, new penalty tiers, automated decision transparency |
| Maximum Australian penalty | For serious interference: the greater of AUD 50 million, three times the benefit, or 30% of adjusted turnover |
| Indian law | Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025; main duties from 13 May 2027 |
| Indian exemption | Section 17(1)(d): data of people outside India processed under a contract with a foreign person |
Does the Privacy Act apply to your group?
The Privacy Act applies to APP entities: Australian Government agencies and most private organisations with annual turnover above AUD 3 million, plus some smaller businesses, such as private health service providers and businesses that trade in personal information. Most Australian groups large enough to run an Indian subsidiary are covered. The Act also follows the data: an organisation with an Australian link remains bound when it handles Australians' information overseas.
The Indian subsidiary itself is a separate company. It is not automatically an APP entity, which is exactly why APP 8 and section 16C put the responsibility on the Australian company that sends it the data.
APP 8 and section 16C: accountability for the Indian team
APP 8.1 requires an APP entity, before it discloses personal information to an overseas recipient, to take reasonable steps to ensure the recipient does not breach the APPs (other than APP 1) in relation to that information. Section 16C then makes the Australian entity accountable for any act or practice of the overseas recipient that would have breached the APPs had the Australian entity done it.
| Way to meet APP 8 | Practical fit for an Indian subsidiary or vendor |
|---|---|
| Reasonable steps, usually an enforceable contract | The normal route: a data processing agreement binding the Indian recipient to APP-equivalent handling, with audit rights |
| Recipient subject to a substantially similar law or prescribed scheme | Not available for India at present; the 2024 reforms allow countries to be prescribed, but India has not been |
| Express informed consent after being told APP 8.1 will not apply | Rarely practical for customers or staff, and it removes the section 16C accountability that individuals rely on |
| Required or authorised by Australian law | Narrow; does not cover ordinary outsourcing |
Because section 16C keeps the liability in Australia, the contract with the Indian team is not a formality: it is how the Australian board gets comfort that it can meet its own obligations.
Use or disclosure: a distinction that matters
The OAIC's guidance treats providing personal information to a contractor as a use, not a disclosure, where the Australian entity keeps effective control of the information: the contractor only acts on instructions, cannot use it for its own purposes, and the entity can retrieve or delete it. A wholly owned Indian subsidiary working inside the Australian company's systems, under strict instructions, can fit this description.
- If the arrangement is a use, APP 8 does not apply, but APP 11 still requires reasonable steps to secure the information, wherever the people handling it sit.
- If the Indian team keeps copies on its own systems, decides how data is used, or shares it onward, the arrangement is more likely to be a disclosure, and APP 8 and section 16C apply.
- In practice many groups design for the stricter outcome: they put an APP 8-grade agreement in place anyway and treat the use argument as a backstop.
Data with stricter rules
| Data | Restriction | Effect on the Indian team |
|---|---|---|
| Tax file numbers | The Privacy (Tax File Number) Rule 2015 limits collection, use and disclosure to tax and related purposes | Indian payroll staff can process TFNs for Australian payroll only within those purposes, with strict access controls |
| My Health Record information | The My Health Records Act 2012 prohibits holding or processing it outside Australia, with limited exceptions | Indian teams must not access or store it |
| Health and other sensitive information | Higher standards for collection and use under the APPs | Limit access, log it and avoid unnecessary copies |
| Consumer Data Right data (banking, energy) | Specific accreditation and handling rules | Check the CDR rules before offshoring any CDR processing |
| Credit reporting information | Part IIIA of the Privacy Act restricts disclosure overseas | Usually kept in Australia or tightly limited |
APRA-regulated entities: CPS 234 and CPS 230
Banks, insurers and superannuation trustees regulated by APRA face two prudential standards that shape an Indian set-up:
- CPS 234 Information Security requires the regulated entity to ensure information security controls at third parties, including related parties such as an Indian captive centre, are commensurate with the threats, and to notify APRA of material incidents within 72 hours.
- CPS 230 Operational Risk Management, in force since 1 July 2025, covers material service providers, including group entities, and requires notifying APRA before entering or materially changing an offshore arrangement with a material service provider.
- Both apply alongside the Privacy Act, so an APRA-regulated group's Indian centre needs security assessments, contract terms and testing that a non-regulated group might not.
What India's DPDP Act adds
For data of people in India, such as the subsidiary's own employees and any Indian customers, the Indian subsidiary is a data fiduciary under the DPDP Act and must meet its duties as they take effect by 13 May 2027: notices and consent or a legitimate use, reasonable security safeguards, breach reporting, erasure when the purpose ends, and a grievance channel.
For Australian residents' data processed in India under a contract with the Australian company, section 17(1)(d) of the DPDP Act exempts the processing from most of the Act; only the general duty to comply and the duty to take reasonable security safeguards remain. Draft the intragroup services agreement so it clearly records that the Indian company processes the data on the Australian company's behalf. Transfers of Indian staff data to Australia are allowed, because India has not restricted Australia as a destination.
Breach notification in both countries
| Australia | India | |
|---|---|---|
| Scheme | Notifiable Data Breaches scheme in Part IIIC of the Privacy Act | DPDP Act and Rules, 2025 |
| Trigger | An eligible data breach: unauthorised access or disclosure likely to cause serious harm | Any personal data breach involving data the fiduciary is responsible for |
| Who is told | The OAIC and affected individuals | The Data Protection Board of India and affected individuals |
| Timing | Assess a suspected breach within 30 days; notify as soon as practicable once it is eligible | Without delay, with a detailed report to the Board within 72 hours |
| Responsible party | The Australian APP entity, even for a breach at the Indian recipient | The Indian subsidiary for Indian data |
An incident in the Indian centre can trigger the Australian scheme, APRA's 72-hour notice for regulated entities, and the Indian rules at once. Keep one incident playbook with all three clocks, and require the Indian team to escalate to Australia within hours.
A checklist for the Australian company
- Map each data flow to India and decide whether it is a use or a disclosure.
- Put an APP 8-grade data processing agreement in place with the Indian subsidiary or vendor, with audit and deletion rights.
- Exclude My Health Record data and apply the TFN Rule to any Australian payroll processing in India.
- For APRA-regulated entities, complete the CPS 234 assessment and the CPS 230 notification before go-live.
- Word the intragroup services agreement so the Indian section 17(1)(d) exemption applies to Australian data.
- Set up DPDP notices and processes for Indian staff data before 13 May 2027.
- Write one breach playbook covering the OAIC, APRA where relevant, and the Data Protection Board.
How AU Corporate handles this
AU Corporate sets up the Indian subsidiary and keeps its intragroup agreements, payroll and compliance consistent with what your Australian privacy and risk teams need. We work with your Australian lawyers on the APP 8 documents and handle the Indian side: the services agreement wording for the non-resident exemption, DPDP processes for Indian staff, and the transfer pricing that the same agreement supports.
Related services: secretarial and ROC compliance and GCC setup in India.
Frequently asked questions
Does APP 8 apply when we send data to our own Indian subsidiary?
Usually yes, if the subsidiary receives the data as a separate company and it is a disclosure. If the Australian company keeps effective control and the subsidiary only acts on its instructions, it may be a use, where APP 11 security duties still apply.
Is India treated as having substantially similar privacy protection?
No. India has not been prescribed, so the Australian company relies on reasonable steps, usually an enforceable contract with the Indian recipient.
Who is liable if the Indian team mishandles Australian data?
Under section 16C of the Privacy Act, the Australian entity that disclosed the information is accountable for the overseas recipient's acts that would breach the APPs.
Can Indian payroll staff process Australian tax file numbers?
Only for the purposes the Privacy (Tax File Number) Rule 2015 allows, such as payroll tax reporting, and with strict security controls.
Can My Health Record data be handled in India?
No. The My Health Records Act 2012 prohibits holding or processing that information outside Australia, with limited exceptions.
Does India's DPDP Act apply to Australian customer data processed in India?
Mostly not. Section 17(1)(d) exempts data of people outside India processed under a contract with a foreign person, except the duties to comply and keep reasonable security safeguards.
What does CPS 230 require for an Indian captive centre?
For APRA-regulated entities, an Indian centre that is a material service provider must be managed under CPS 230, including notifying APRA before entering or materially changing the offshore arrangement.
What are the maximum Australian privacy penalties?
For serious interference with privacy, the greater of AUD 50 million, three times the benefit obtained, or 30% of adjusted turnover in the relevant period.
Related guides
GCC for Australian Companies
Running a captive centre in India.
Read the guide →Hiring and Payroll
Indian staff contracts and HR data.
Read the guide →Transfer Pricing
Pricing the intragroup services agreement.
Read the guide →Australian Parent Obligations
Australian reporting on the Indian company.
Read the guide →Sources
Last updated 3 November 2026. General information only, not legal or tax advice. Indian rules change often; confirm current requirements before acting.