By the PCS team. Published November 5, 2026.
Generally yes, but the legal duty stays with you, and Fiji's own law will not do the work for you. New Zealand's IPP 12 and Australia's APP 8 both allow overseas disclosure under conditions. As of 5 November 2026 we could not find a general data protection act in Fiji, so in practice you rely on a contract and evidence. This is general information, not legal advice.
Start with what actually happens to the data
The legal answer turns on the facts of your setup, so write those down first. Most Fiji arrangements look like one of these three.
| Setup | New Zealand: the question | Australia: the question |
|---|---|---|
| The team logs in to your CRM or accounting file from Suva. Nothing is kept on the provider's systems. | Does the provider hold the information only as your agent? If so, section 11 treats it as held by you, and you stay responsible. | Giving an overseas contractor access is generally a disclosure, so plan on APP 8 applying. |
| The team works in your systems, but the provider's platform records calls or keeps copies. | Same question, for each provider system. Does it hold the data only for you? | APP 8 applies, and the contract should cover storage, access and deletion. |
| The provider also uses the information for its own purposes. | Section 11 treats it as held by both of you, and IPP 12 is squarely in play. | APP 8 and section 16C both matter. Ask why this is needed at all. |
Ask your adviser which row you are in. The rest of this post sets out what each regulator says.
New Zealand: IPP 12 and section 11
IPP 12 governs disclosing personal information to a foreign person or entity. According to the Office of the Privacy Commissioner, you may do that if you believe, on reasonable grounds, that the recipient will protect the information with safeguards comparable to the Privacy Act. An agreement is one way to get there, not the only way, and IPP 12 does not apply to every disclosure. The Commissioner publishes a decision tree and model contract clauses you can adopt or adapt.
Section 11 is the part outsourcing buyers tend to miss. Where an agency holds information as an agent for another agency, for safe custody or processing, it is treated as held by the principal. If the agent also uses or discloses it for its own purposes, it is treated as held by both. The Commissioner uses cloud storage as the example, and says that in most circumstances you remain responsible for what you put there.
Two practical points from the same guidance: you stay responsible for being satisfied the safeguards are comparable, and enforcing an agreement against an overseas party is hard and depends largely on the commercial relationship. So pick a provider you can actually reach, and keep the evidence on file.
If a breach has caused or is likely to cause serious harm, you must notify the Commissioner and affected people as soon as you are practically able (Office of the Privacy Commissioner, privacy breaches). Your contract needs to get that news to you in time.
Australia: APP 8 and section 16C
Before disclosing personal information overseas, you must take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles. The OAIC APP guidelines, chapter 8, last updated 3 October 2025, generally expect an enforceable contract requiring APP-compliant handling, a complaints process and a data breach response plan. What is reasonable depends on the sensitivity of the information, your relationship with the recipient, the possible harm, the recipient's safeguards and practicality.
Section 16C makes you accountable for acts of the overseas recipient that would breach the APPs, even where you took reasonable steps. The exceptions are narrow.
Is it a use or a disclosure? The guidelines say giving information to an overseas contractor is generally a disclosure. Sending information to a cloud provider for storage may instead be a use, if a binding contract limits the provider, subcontractors are bound the same way, and you keep effective control. A staffed team working with your customers' records looks much more like the first than the second, so plan on APP 8 applying.
The exceptions. APP 8.2 includes a reasonable belief that the recipient is subject to a substantially similar law with an enforcement mechanism, and informed consent where you have expressly told the person APP 8.1 will not apply. A prescribed-countries exception was added for disclosures from 11 December 2024. The OAIC page lists no countries, so check the Federal Register of Legislation rather than assuming Fiji is on it.
The Notifiable Data Breaches scheme also applies: covered organisations must notify affected individuals and the OAIC when a data breach is likely to result in serious harm (OAIC, Notifiable Data Breaches scheme).
Fiji: what exists and what does not
We could not find a single general data protection act in Fiji as of 5 November 2026. What we did find:
- Fiji's Constitution includes a right to privacy, and DLA Piper, Data Protection in Fiji describes the protection as resting on that and on sector-specific laws.
- Cabinet has endorsed a National Privacy and Personal Data Protection Policy, reported as laying the foundation for legislation (fijivillage).
- The Fiji Ministry of Finance fact sheet, February 2024 lists designing and enacting data protection and privacy laws as a future step.
- The Council of Europe ran a multi-stakeholder dialogue on the data protection framework in Suva from 23 to 27 March 2026.
What that means for you: do not lean on Fiji's general law to meet the comparable-safeguards test in New Zealand or the substantially-similar-law exception in Australia. Lean on the contract, the provider's controls and the evidence you hold. We will update this post when the law changes, and you should check the current position with your adviser before you sign.
What to put in the contract
- What personal information is involved, and the only purposes it may be used for
- That the provider will not use or disclose it for its own purposes
- Security controls, named at a level you can check, and the certified site
- Where the data is accessed from, and notice before that changes
- Any subcontractors or platforms, bound the same way
- Incident notice, in hours you can live with, and who does what
- Help with access, correction and complaint requests
- Return or deletion at exit, and your right to check
Where PCS stands
ISO/IEC 27001:2022, certificate 250208056701, held by Proficient Customer Solutions (Fiji) Pte Ltd, our Suva delivery company, issued by TNV System Certification under IAS accreditation, valid to 7 Feb 2028. How to verify it, step by step. A certificate is evidence, not compliance: it does not meet IPP 12 or APP 8 for you.
Our teams usually work inside your own systems, with individual named logins you control and can revoke, and confidentiality agreements at both company and individual level. That is still access from overseas, so it belongs in your privacy assessment. We work under confidentiality and data-handling terms set for each engagement, and we complete standard security questionnaires. We are an outsourcing provider, not a law firm, so have your adviser read the arrangement.
Frequently asked questions
Is it legal to send customer data to a team in Fiji?
Generally yes, if you meet the conditions. New Zealand's IPP 12 needs reasonable grounds to believe the recipient will apply comparable safeguards, unless the provider only holds the information as your agent. Australia's APP 8 expects reasonable steps, usually an enforceable contract, and you stay accountable under section 16C. This is general information, not legal advice.
Does Fiji have a privacy or data protection act?
We could not find a single general data protection act as of 5 November 2026. Fiji's Constitution includes a right to privacy and Cabinet has endorsed a National Privacy and Personal Data Protection Policy, reported as the foundation for legislation. Check the current position with your adviser.
Does an ISO 27001 certificate make it compliant?
No. It is evidence of an audited information security management system. It can support your reasonable grounds or reasonable steps, but it does not meet IPP 12 or APP 8 on its own.
If the team only logs in to our systems, has the data left the country?
It may not be stored overseas, but it is being accessed from overseas. The OAIC treats making information accessible to an overseas contractor as generally a disclosure, so plan on APP 8 applying. In New Zealand, ask whether section 11 applies because the provider acts only as your agent.
Do we still have to notify a breach if it happens at the provider?
Plan on yes. New Zealand and Australia both require notification where a breach is likely to cause serious harm. Your contract should get the news to you quickly and say who does what.
Sources read on 5 November 2026 unless a date is shown. This post is general information, not legal advice.