Offshore staff in Australian law firms: obligations, risks and controls
Last reviewed 21 October 2026. General information for Australian law practices. Not legal advice.
Many Australian law firms now use offshore employees, contractors, virtual assistants and outsourced service providers. The work ranges from file administration, data entry and billing to paralegal support, bookkeeping, conveyancing administration and IT support.
Used well, offshore capacity is a legitimate way to run a practice. But the firm's obligations do not move offshore with the work. Confidentiality, supervision, privacy, security and, for many firms, AML/CTF duties stay with the Australian law practice and its principals.
This page sets out the obligations that apply, where the practical risks usually sit, and the controls that let a firm show, rather than assume, that its offshore arrangements are under control.
Quick answers
Can an Australian law firm use offshore staff?
Yes. No general rule prohibits it. The firm must still meet its professional, privacy, security and AML/CTF obligations, and must be able to supervise the work.
Does giving offshore staff access to client information count as a disclosure under the Privacy Act?
Often, yes. Under the OAIC's guidance, providing personal information to an overseas contractor is generally a disclosure. It may be treated as a "use" only where the firm keeps effective control of the information. See APP 8 below.
Who is responsible if an offshore provider mishandles client information?
For personal information, where APP 8 applies, the firm can be held accountable for the overseas recipient's acts under section 16C of the Privacy Act. Professionally, the duty of confidentiality and the obligation to supervise remain with the firm.
Is my small firm exempt from the Privacy Act?
Possibly not. Firms providing AML/CTF regulated services from 1 July 2026 are treated as covered by the Privacy Act for personal information handled for AML/CTF purposes, whatever their turnover. See Who the Privacy Act covers.
What is the most common gap?
Not knowing exactly who has access. Firms often cannot produce a current list of offshore personnel, the systems each can reach, and the devices they work from.
What counts as "offshore operations"
For this page, offshore operations means any arrangement in which people located outside Australia perform work for the firm or can access its systems or information. Common models include:
| Model | How it works | Who the firm contracts with |
|---|---|---|
| Direct offshore employee | The firm employs the person in another country, often through an Employer of Record (EOR) | The EOR, and sometimes the individual |
| Staff placement agency | An agency recruits and employs staff who work exclusively for the firm | The agency |
| Business process outsourcing | A provider delivers a defined service (for example, bookkeeping or data entry) using its own staff | The provider |
| Freelance or marketplace contractor | An individual engaged directly, often through a platform | The individual or the platform |
| Offshore IT support | A managed service provider or help desk with offshore technicians | The IT provider |
The risk profile differs between these models. The more layers between the firm and the person doing the work, the harder it is to know who that person is, what they can access, and whether further subcontractors are involved.
Offshore IT support is often overlooked. A help desk technician with administrator rights can usually reach far more client information than any paralegal.
Professional obligations
Confidentiality
Rule 9 of the Australian Solicitors' Conduct Rules requires a solicitor not to disclose information that is confidential to a client, subject to limited exceptions. The rule does not distinguish between onshore and offshore personnel. Giving offshore staff access to client files is compatible with the rule only where the firm has arrangements that keep that information confidential in practice:
- personnel are bound by enforceable confidentiality obligations;
- access is limited to the matters and information each person needs;
- information cannot readily be copied, downloaded or sent outside the firm's systems; and
- the firm can detect and respond if confidentiality is breached.
Supervision
Rule 37 requires a solicitor with designated responsibility for a matter to exercise reasonable supervision over solicitors and all other employees engaged in providing the legal services for that matter. Distance does not reduce that duty. For offshore personnel, reasonable supervision usually means the firm can show:
- who allocated each task and who reviewed the output;
- that work is reviewed and approved before it is issued to a client or third party;
- that offshore personnel work within defined task boundaries; and
- that supervisors have visibility of work in progress and critical dates.
The NSW Law Society's guidance on remote supervision of supervised practitioners is a useful reference point. It covers regular contact, workflow visibility, review and approval of legal work, file reviews and secure file sharing. Those same disciplines translate well to supervising non-lawyer staff who work remotely or offshore.
The work remains the firm's work
Offshore personnel support the delivery of legal services; they do not provide legal services in their own right. Task design should keep legal judgement and advice with Australian practitioners, and keep client-facing communications under the firm's control. Where an arrangement drifts into offshore personnel effectively running matters, the firm's supervision position becomes much harder to defend.
Professional indemnity and insurers
Insurers increasingly ask about outsourcing, remote access and cyber controls in proposal forms and at renewal. A firm should be able to describe its offshore arrangements accurately and support its answers with evidence. An answer that cannot be supported is a risk if a claim is later made.
Privacy Act obligations
Who the Privacy Act covers
The Australian Privacy Principles (APPs) apply to "APP entities". Many smaller law firms with annual turnover of $3 million or less have historically relied on the small business exemption. Three points matter:
- AML/CTF reporting entities. A small business that is a reporting entity under the AML/CTF Act is treated as an organisation, and so covered by the APPs, for activities it carries on for AML/CTF purposes. With legal practices providing regulated services coming into the AML/CTF regime from 1 July 2026, many smaller firms are now APP entities for at least part of their personal information handling.
- Other triggers. Some activities remove the exemption regardless of turnover, such as providing a health service or trading in personal information.
- Reform. The Government has agreed in principle to remove the small business exemption, subject to further consultation. As at the date of this page, it has not been removed.
Even where a firm is exempt, its professional duty of confidentiality applies to all client information, and the APPs remain the benchmark clients, insurers and regulators use to judge reasonable practice.
APP 8: cross-border disclosure
APP 8 applies where an APP entity discloses personal information to an overseas recipient.
Use or disclosure? The OAIC's APP Guidelines (Chapter 8) distinguish between:
- Disclosure: making information accessible to others outside the entity and releasing its subsequent handling from the entity's effective control. Providing personal information to an overseas contractor is generally a disclosure.
- Use: handling that remains within the entity's effective control. The Guidelines give the example of overseas cloud storage where a binding contract limits the provider's handling, flows obligations down to subcontractors, and preserves the entity's rights to access, retrieve and delete the data.
For most offshore staffing and outsourcing arrangements, firms should assume APP 8 applies unless they can clearly demonstrate effective control.
Reasonable steps (APP 8.1). Before disclosing, the firm must take reasonable steps to ensure the overseas recipient does not breach the APPs. The OAIC generally expects an enforceable contractual arrangement. Terms commonly include:
- the purposes for which the information may be handled and the types of information involved;
- an obligation to handle the information consistently with the APPs;
- restrictions on further disclosure, and flow-down of obligations to subcontractors;
- security requirements;
- complaint handling; and
- a data breach response obligation, including notifying the firm promptly.
What counts as reasonable depends on the sensitivity of the information, the relationship with the recipient, the possible harm, and the recipient's own safeguards. Cost and inconvenience alone do not justify taking no steps.
Accountability (section 16C). Where APP 8.1 applies, acts of the overseas recipient that would breach the APPs are treated as acts of the Australian entity. This applies even if the firm took reasonable steps and even if the breach was by a subcontractor. In practice, the firm carries the privacy consequences of its provider's failures.
Exceptions (APP 8.2). Exceptions include a reasonable belief that the recipient is subject to a law or binding scheme substantially similar to the APPs, with accessible enforcement mechanisms, and informed consent. Consent is a narrow route. The individual must be expressly told that the firm will not be accountable for the overseas recipient and that they cannot seek redress under the Privacy Act. Relying on general consent wording in a costs agreement is unlikely to be sufficient.
Foreign law. The Guidelines note that an act required by a foreign law, done outside Australia, does not breach the APPs. This cuts both ways. If the provider's home jurisdiction can compel access to information, the firm may have no Privacy Act remedy, which is itself a risk to assess before choosing a location.
Privacy policy. APP 1 requires an entity's privacy policy to state whether it is likely to disclose personal information to overseas recipients and, if practicable, the countries involved. Many firms using offshore staff have not updated their policy to say so.
APP 11: security of personal information
APP 11 requires reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure, and to destroy or de-identify it when no longer needed. For offshore arrangements this translates into concrete technical and organisational controls, covered in Where the risk sits in Microsoft 365.
Notifiable Data Breaches
Under the Notifiable Data Breaches scheme, an entity that suspects an eligible data breach must assess it, generally within 30 days, and notify the OAIC and affected individuals as soon as practicable if it is likely to result in serious harm. For offshore arrangements, two questions matter:
- Will the provider tell the firm quickly enough for the firm to meet its own obligations?
- Can the firm investigate what happened? That depends on audit logs the firm controls and retains.
Statutory tort for serious invasions of privacy
Since June 2025, individuals have had a statutory cause of action for serious invasions of privacy, including misuse of information. It sits alongside the APPs and is a further reason to treat access by offshore personnel as a governance matter, not just an IT setting.
AML/CTF obligations
From 1 July 2026, legal practices that provide regulated (designated) services, such as certain real estate, trust and company services, are reporting entities under the AML/CTF Act. Enrolment with AUSTRAC is required within 28 days of first providing a regulated service.
Offshore arrangements intersect with AML/CTF in several ways:
- Who performs AML/CTF functions. If offshore personnel collect identity documents, run verification checks, screen clients or prepare records, those activities sit inside the firm's AML/CTF program. The program's risk assessment, policies and controls need to reflect the delivery model.
- Personnel controls. AML/CTF programs are expected to address the people who carry out AML/CTF functions, including appropriate screening and training. That applies to offshore personnel as much as onshore staff.
- Records. AML/CTF records generally need to be kept for seven years and be retrievable. If records are created or stored through offshore processes, the firm needs to know where they are and how they are retained.
- Privacy. As noted above, AML/CTF activity brings personal information within the Privacy Act for small firms, including APP 8 where that information goes offshore.
- Oversight. Program governance sits with senior management and the AML/CTF compliance officer. Delegating tasks offshore does not delegate accountability.
Cyber incidents
Under the Cyber Security Act 2024, businesses with annual turnover above $3 million that make, or are aware of, a ransomware or cyber extortion payment must report it to the Australian Signals Directorate. Offshore access is one of the paths through which these incidents begin, for example through a compromised account or an unmanaged device.
The ACSC's Essential Eight is not mandatory for private firms, but it is the reference most Australian insurers and advisers use. Several of its strategies apply directly to offshore access: multi-factor authentication, restricting administrative privileges, application control, and regular backups.
Where the risk sits in Microsoft 365
For most Australian law firms, offshore personnel work inside the firm's Microsoft 365 tenant as well as its practice management system. That is good news: Microsoft 365 records most of the evidence needed to show what is happening, and provides the controls needed to manage it. The question is whether those controls are switched on and configured for offshore access.
| Area | What to establish | Controls that typically address it |
|---|---|---|
| Who has access | A complete list of offshore accounts, matched to named, current personnel | Entra ID sign-in logs reviewed by location; a maintained register of offshore accounts; guest account reviews |
| Authentication | Every offshore account uses strong multi-factor authentication | MFA enforced through Conditional Access; phishing-resistant methods for privileged accounts |
| Where and from what | Access only from approved countries and approved devices | Conditional Access with named locations and device compliance requirements |
| Devices | Client information is not stored on unmanaged personal devices | Intune device enrolment and compliance; or Windows 365 Cloud PC or Azure Virtual Desktop, so data stays in the firm's environment |
| Data movement | Information cannot leave approved systems unnoticed | Purview data loss prevention; sensitivity labels; restrictions on downloading, printing and syncing; blocking automatic forwarding to external email |
| Email rules | No hidden forwarding or rules that divert client mail | Review of mailbox forwarding and inbox rules; alerts on new external forwarding |
| AI tools | Client information is not pasted into consumer AI services | Defender for Cloud Apps discovery and blocking; an approved AI tool list; endpoint DLP |
| Least privilege | Each person can reach only the matters and sites they need | SharePoint and Teams permissions by matter or team; removal of organisation-wide sharing links; regular access reviews |
| Administrative access | No offshore account holds standing administrator rights without justification | Entra role review; Privileged Identity Management for time-limited elevation |
| Evidence | The firm can investigate an incident after the event | Unified audit logging enabled; log retention long enough to cover the firm's detection window |
| Leavers | Access ends on the day an engagement ends | A documented offboarding process tied to the provider's notice; disabled accounts and revoked sessions; reclaimed devices or Cloud PCs |
Two technical points catch many firms out:
- Log retention depends on licensing. On Microsoft 365 plans without Entra ID P1, sign-in logs are kept for only 7 days. Business Premium and higher plans include P1, which extends this to 30 days. A firm that learns of an incident three weeks later may have no sign-in evidence left.
- Visibility of AI use depends on licensing. Discovering which cloud and AI applications staff use requires Defender for Cloud Apps, included in some plans and available as an add-on in others.
The practice management system needs the same scrutiny. Most practice management platforms have their own user lists, roles and access logs, which should be reconciled with the Microsoft 365 position.
Supervision in practice
Supervision evidence is often where offshore arrangements are weakest. The work may be well supervised, but nothing records it. Practical measures include:
- Defined task boundaries. A written list of what offshore personnel may and may not do, by role.
- Work allocation through systems. Tasks allocated through the practice management system or Microsoft 365, not informal messaging, so the record exists.
- Review before release. Nothing leaves the firm without review by an Australian practitioner where the work requires it.
- Escalation paths. Clear points at which offshore personnel must refer a matter, for example any client instruction, conflict concern or suspicious transaction.
- Periodic file sampling. A small, regular sample of work reviewed for quality and confidentiality, with the review recorded.
Provider and contract checklist
Whether the firm contracts with an agency, an EOR, an outsourcing provider or an individual, the agreement should cover at least the following:
- Identity and vetting of each person assigned to the firm, and notice before any change
- A prohibition on subcontracting without the firm's written consent
- Confidentiality obligations binding the provider and each individual
- Handling of personal information consistent with the APPs, including flow-down obligations
- Security requirements, including device standards and a prohibition on local storage of client information
- Prompt notification of any actual or suspected breach, with cooperation in investigation
- The firm's right to audit, or to receive evidence of, the provider's controls
- Return and deletion of information on termination, with written confirmation
- Same-day notice of departures so access can be removed
- Business continuity commitments and the firm's position if the provider stops operating
- The governing law and how disputes are resolved
A provider's ISO 27001 certification or SOC 2 report is useful, but it covers the provider's own environment. It does not show how the firm's tenant, permissions and devices are configured, which is where most client information actually sits.
Offboarding and continuity
Offboarding is the single most testable control. A firm should be able to show, for each departed offshore worker, the date the engagement ended and the date each account was disabled. Gaps of weeks or months are common where the provider does not notify the firm promptly.
Continuity deserves equal attention. If an offshore team becomes unavailable through a provider failure, a regional outage or a change in local law, the firm should know which work is affected, who would cover it, and whether it can retrieve all work in progress from its own systems.
Common gaps
The following gaps are common when firms first review offshore arrangements against evidence:
- More accounts sign in from overseas than the firm has declared, including accounts of people who have left.
- Offshore personnel work on personal devices with client documents stored locally.
- No data loss prevention, and no restriction on downloads or external forwarding.
- MFA is enforced, but sign-ins are accepted from any country and any device.
- The provider agreement has a confidentiality clause but no breach notification, audit, subcontracting or data return terms.
- The privacy policy does not mention overseas disclosure.
- Supervision happens, but nothing records it.
- Log retention is too short to investigate an incident discovered late.
Could you answer these questions today?
- Who is currently performing work for the firm offshore, and where are they located?
- Does your provider use subcontractors?
- Which client and matter information can each offshore person access?
- Which systems can they reach, and from which devices?
- Can information be downloaded, forwarded or stored outside approved systems?
- How is offshore work supervised, and where is that recorded?
- What happens, and how quickly, when an offshore worker leaves?
- How would an incident at the provider reach you, and could you investigate it?
- What happens if the offshore service becomes unavailable tomorrow?
If some answers are "we think so" rather than "we can show you", the arrangement warrants a closer look.
Frequently asked questions
-
Not as a general rule. Consent is one of the APP 8.2 exceptions, but it is narrow and requires specific warnings to the individual. Most firms instead rely on reasonable steps, including an enforceable contract, and accept accountability under section 16C. Some clients, such as government bodies and financial institutions, impose their own restrictions on offshore access through panel terms, so check client engagement terms as well.
-
Yes. A staffing agency supplies people who work under the firm's direction and supervision. A legal process outsourcer delivers work through its own processes and supervision. The firm's supervision, confidentiality and contractual considerations differ, and outsourcing legal work to another entity raises additional professional conduct questions.
-
It is a good sign about the provider's own controls. It does not tell you how your own systems are configured for their staff, which is where most of the risk sits.
-
Yes. The country affects whether an APP 8.2 exception might apply, whether local law can compel access to information, and practical matters such as time zones for supervision. Some clients also restrict particular jurisdictions.
-
They can perform tasks within the firm's AML/CTF program, provided the program covers that delivery model and the people involved are screened and trained. Accountability stays with the firm's senior management and AML/CTF compliance officer.
-
At a minimum, whenever personnel change and at regular intervals, typically quarterly. Access and evidence drift as people, roles and systems change.
How JurisIT helps
JurisIT works with Australian law firms to establish, with evidence, how their offshore arrangements actually operate.
- Offshore Operations Risk Snapshot (free): a short structured assessment that shows where your arrangements may need a closer look.
- Offshore Operations Risk Review: an evidence-based review of your Microsoft 365 environment, provider arrangements and supervision records, giving you a documented baseline and a prioritised list of what to address.
Findings are yours to act on with your own IT provider, your offshore provider or JurisIT.
References
- Office of the Australian Information Commissioner, Australian Privacy Principles Guidelines, Chapter 8: APP 8 Cross-border disclosure of personal information
- Office of the Australian Information Commissioner, Sending personal information overseas
- Privacy Act 1988 (Cth), including sections 6E, 16C and Part IIIC (Notifiable Data Breaches)
- Australian Solicitors' Conduct Rules, rules 9 and 37
- Law Society of NSW, Remote supervision guidance
- AUSTRAC, Summary of AML/CTF obligations for tranche 2 entities
- Cyber Security Act 2024 (Cth), Part 3 (ransomware payment reporting)
- Australian Cyber Security Centre, Essential Eight
This page provides general information about obligations that commonly apply to Australian law practices using offshore personnel. It is not legal advice and does not address every jurisdiction's legal profession rules. Firms should obtain advice on their specific arrangements.