An Australian business, a development team in India: what to check first

Often it does not, which surprises people. The OAIC explains that most small businesses, defined as those with an annual turnover of three million Australian dollars or less, are not covered by the Privacy Act 1988, though some are, for example certain health service providers and businesses that trade in personal information. Check the OAIC's small business guidance against your own situation before assuming either way.

If you are covered, the 13 Australian Privacy Principles apply, and one of them is the reason this page exists: APP 8 sets out the steps you must take before disclosing personal information overseas. A team in India that can read your customer records is an overseas recipient, so the contract and the system design need to account for it. As of November 2026; general information, not legal advice.

Under the Spam Act 2003, three rules in the Act's own section headings do most of the work: unsolicited commercial electronic messages must not be sent, they must include accurate sender information, and they must contain a functional unsubscribe facility. That covers SMS as well as email, which matters if your lead follow-up texts people.

When we build automatic lead follow-up for an Australian business, the opt-in is recorded with a timestamp, the sender name is your business rather than a tool, and unsubscribes take effect in every connected system, not just the email tool. If enquiries are tracked properly in analytics too, our note on tracking enquiries in GA4 shows how to do it without sending personal details to Google.

Hosting your database in an Australian cloud region keeps the stored data in the country, and some clients prefer it for that reason alone. It does not settle the APP 8 question on its own, though: if a developer in India can open the records to fix a bug, that access is still disclosure overseas. The practical answer is to decide both together. We usually keep production data in the client's own cloud account, in the region the client chooses, give our team the narrowest access the work needs, and use anonymised copies for development wherever the task allows. That is easier to explain to your customers and to an auditor than a vague assurance.

The Disability Discrimination Act 1992 covers the provision of goods, services and facilities. It does not set a technical standard for websites itself; the W3C's Web Content Accessibility Guidelines are the widely used one, and we build to WCAG 2 AA by default and test keyboard navigation, focus order, contrast and form errors before launch.

This is easier to get right on a new build than to retrofit, which is one reason we use server-rendered Next.js sites with plain, semantic HTML underneath the design.