← VCE Software Development U3O2

APP 8: sending personal data overseas

Before sending personal information overseas, such as to a cloud server, an organisation must take reasonable steps to make sure the overseas recipient will also protect it.

Part of: VCE Software Development - U3O2 - Analysis and Design — Module 62, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 102, 9-10 Digital Technologies: Data privacy and the Australian Privacy Principles — Module 12, ACARA Digital Technologies Years 9–10 — Privacy Principles and Digital Footprints — Module 24, QCE Digital Solutions Unit 4 — Digital Methods for Exchanging Data — Module 72, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 44, WA Computer Science ATAR Year 11 — Data Management — Module 98, WA Computer Science ATAR Year 11 — Cyber Security — Module 155

Understanding APP 8: sending personal data overseas in VCE Software Development U3O2

What it does: The check runs when data is going to an overseas server, which is what APP 8 covers. A contract is a reasonable step because it makes the overseas recipient agree to protect the personal information. Reasonable steps are practical actions, such as contract terms or checking security, that make it likely the data will be protected. Apps with overseas servers must think about APP 8. APP 12 is about people getting access to their own information, which is a different issue. APP 8 is the Australian Privacy Principle about sending personal information offshore, such as to a cloud server. APP 8 requires the checks to happen before the personal information leaves Australia.

Common mistakes: APP 8 applies when personal information is sent overseas, not kept in Australia. The condition should be IF sending data overseas THEN. APP 8 requires reasonable steps to check that the overseas recipient will protect the data. The line should be CHECK recipient privacy rules, not ignore them.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add APP 8: sending personal data overseas to a class →

This module's key terms are also in a printable crossword (Modules 52–71) and word search (Modules 52–85).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A Victorian school wants to store student names on a cloud server in another country. What does APP 8 say the school must do first?
Nothing, because cloud servers are always covered by Australian lawTake reasonable steps to make sure the overseas company will protect the information
Matches
upload(userData, overseasServer) // no checks
↓
The data is sent offshore without any reasonable steps to check that the recipient will protect it. Check the provider first, then upload.
Applying
Meanings
Term
APP 8
Meaning
Before sending personal information overseas, such as to a cloud server, an organisation must take reasonable steps to make sure the overseas recipient will also protect it.
Practice
SET destination = "overseas cloud server"
Testing
Gaps
IF serverCountry "Australia" THEN
Check Answer
Spots
1IF sending data locally THEN
2 take reasonable steps

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Sperm Whale' badge — Deep Sea Champion, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A Victorian school wants to store student names on a cloud server in another country. What does APP 8 say the school must do first?
A. Take reasonable steps to make sure the overseas company will protect the information ✓
B. Nothing, because cloud servers are always covered by Australian law
APP 8 applies before personal information is sent offshore. The organisation must take reasonable steps to check the overseas recipient will protect it.
2. Which situation is covered by APP 8?
A. An Australian app company sends user details to a server located overseas ✓
B. A student saves their own homework to a USB drive at home
APP 8 is about disclosing personal information to an overseas recipient, such as a company running servers in another country.
3. What does 'reasonable steps' mean under APP 8?
A. Sensible checks, like a contract that requires the overseas company to protect the data ✓
B. Hoping the overseas company is careful and not asking any questions
Reasonable steps are practical actions, such as contract terms or checking security, that make it likely the data will be protected.
4. True or false: APP 8 only matters AFTER the personal information has already been sent overseas.
A. True. The checks happen after the data arrives
B. False. The steps must be taken before it is sent ✓
APP 8 is about prevention. An organisation must take reasonable steps before sending personal information offshore.
5. Which is the better example of a reasonable step before using a cloud service in another country?
A. Choosing the cheapest provider without reading its terms
B. Signing a contract that requires the provider to keep the data secure ✓
A contract with privacy and security requirements is a clear reasonable step. Ignoring the terms is not.

Match the Pairs

APP 8 → Before personal information is sent overseas, the organisation must take reasonable steps to make sure the overseas recipient will also protect it.
reasonable steps → Sensible actions, like checking a contract or privacy policy, to make sure an overseas company will protect the data.
An app stores user photos on servers in another country, so the company must check the overseas provider's protections first. → IF server_country != Australia THEN check_overseas_protection()
One reasonable step is a contract that requires the overseas cloud provider to follow privacy rules. → contract.require(privacy_rules)
upload(userData, overseasServer) // no checks → The data is sent offshore without any reasonable steps to check that the recipient will protect it. Check the provider first, then upload.
IF server_country != Australia THEN skip_APP8 → This wrongly skips APP 8 for overseas servers. APP 8 applies exactly when data is sent overseas, so the checks should run in that case.

Key Term

APP 8
Before sending personal information overseas, such as to a cloud server, an organisation must take reasonable steps to make sure the overseas recipient will also protect it.

Fill in the Blanks

1. IF serverCountry != "Australia" THEN takeReasonableSteps(recipient) END IF
Hint: Type the comparison operator meaning 'not equal to', so the check runs when the server is offshore.
2. IF dataGoesOffshore THEN takeReasonableSteps(overseasRecipient) END IF
Hint: Type the function name for what APP 8 says an organisation must do before sending data overseas.
3. IF recipientProtects = TRUE THEN sendData(customerInfo) END IF
Hint: Type the Boolean value that shows the overseas recipient will protect the data, so it is safe to send.
4. IF serverCountry != "Australia" THEN takeReasonableSteps(cloudProvider) END IF
Hint: Type the keyword that starts the block of steps run when the offshore condition is true.
5. overseas ← serverCountry != "Australia" IF overseas THEN takeReasonableSteps(recipient)
Hint: Type the variable name that was set to record whether the cloud server is in another country.

Spot the Error

Question 1
A IF sending data locally THEN
B take reasonable steps
C confirm recipient protects it
D SEND data to cloud server
Line A — APP 8 applies when personal information is sent overseas, not kept in Australia. The condition should be IF sending data overseas THEN.
Question 2
A recipient ← cloud in Japan
B IGNORE recipient privacy rules
C IF check passed THEN
D SEND personal data
Line B — APP 8 requires reasonable steps to check that the overseas recipient will protect the data. The line should be CHECK recipient privacy rules, not ignore them.
Question 3
A app ← photo app
B server ← overseas
C IF reasonable steps taken THEN
D DO NOT SEND data to server
E ELSE ask for a safer provider
Line D — When reasonable steps have been taken, the data can be sent. This line is the wrong way round. It should be SEND data to server.
Question 4
A // APP 8 covers local data
B recipient ← cloud in Ireland
C CHECK recipient protects data
Line A — APP 8 is about personal information sent overseas, such as to a cloud server in another country. The comment should say overseas data.
Question 5
A app ← study planner app
B servers ← overseas
C steps ← none
D IF steps taken THEN upload
Line C — APP 8 needs reasonable steps, such as a contract or a privacy audit. Taking no steps does not meet it. It should list real steps like contract + audit.

Student with a class code? Join your class →