The Australian Data Privacy Compliance Checklist for Businesses Hiring Offshore

Safeguarding Data Privacy

This is the checklist we walk Tarino clients through. It’s practical, not paranoid. It is general guidance rather than legal or compliance advice, so get independent advice on your own obligations. For how we handle candidate and client information ourselves, see our security page.

Legal and contractual protections

Before you think about tools or technology, get the legal foundation right. Your employment or contractor agreement needs to do more than cover scope and pay. It needs to create clear, enforceable obligations around how client data is handled.

At a minimum, include:

Confidentiality and non-disclosure obligations

Permitted use of systems and data (and what’s explicitly prohibited)

Prohibition on unauthorised sharing, screenshots, downloads, or third-party access

Immediate notification requirements if a breach or suspected breach occurs

Return or deletion of data and materials at end of engagement

From a compliance standpoint, the Philippines operates under the Data Privacy Act of 2012, which creates meaningful obligations around personal information handling. From the Australian side, APP 8 of the Privacy Act 1988 requires ‘reasonable steps’ before disclosing personal information overseas. The controls above are the kind of steps businesses commonly take toward that standard, but what counts as reasonable depends on your business and the data involved. The Office of the Australian Information Commissioner publishes guidance on APP 8.

Because Tarino works on a direct hire model, you hire the person and the agreement is between you and them. If you don’t have an agreement template, ask us and we can share general pointers, but have a lawyer review the final document.

Use enterprise-grade tools with permission controls

Work inside platforms where you control access, not the other way around.

Recommended tools:

Microsoft 365 (Word, Excel, Outlook, SharePoint, Teams) - permission-based access, audit logs, conditional access policies

Google Workspace - shared drives with folder-level permissions, admin console visibility

Slack or Microsoft Teams - for day-to-day communication with channel-level access controls

1Password or Bitwarden for Teams - share credentials safely without sending passwords in plain text

Notion or Confluence - internal documentation with role-based access

Access should be on a strict need-to-know basis. Your offshore hire should only see what’s required for their role - nothing more.

Use a cloud desktop for sensitive roles

For roles that touch sensitive client data regularly, a cloud desktop keeps work inside a controlled environment rather than on a personal device in the Philippines.

Options worth considering:

Windows 365 Cloud PC - Microsoft-managed, integrates with Entra ID (Azure AD), easy to provision and revoke

Azure Virtual Desktop - more configurable, suits larger or more complex setups

Amazon WorkSpaces - strong alternative if you’re already in the AWS ecosystem

Citrix DaaS - enterprise-grade, often used in financial services and legal

A cloud desktop lets you:

Block local downloads and USB transfers

Restrict copy/paste outside the environment

Centralise security monitoring and logging

Revoke access instantly if needed

Strengthen account and device security

Simple settings that make a material difference:

Multi-factor authentication (MFA) on every account - no exceptions

Strong password policy enforced through your platform admin console

Automatic screen lock after 5-10 minutes of inactivity

Endpoint protection enabled (Microsoft Defender, Malwarebytes, or equivalent)

USB storage restricted where the role doesn’t require it

Conditional access policies to restrict logins by device or location (available in Microsoft 365 Business Premium and above)

VPN required for access to any sensitive internal systems

Background checks and identity verification

Screening is where data security starts. Tarino typically starts with 1,000+ candidates per role. About 40% get through CV and quality screening, 20% through video screening, 10% through a practical assessment, 5% through a structured interview and 2% through finalist review, and background checks are part of the process before you see a shortlist of 3–4. For higher-sensitivity roles, tell us on the call what extra checks you need.

Once hired, some clients also choose to represent offshore team members transparently in professional profiles (e.g. LinkedIn) with clear location and engagement type. This builds trust with their own clients and stakeholders.

Train your team from day one

The best tools in the world don’t help if your hire doesn’t know how to use them correctly. We recommend a short onboarding session that covers:

Which platforms to use, and which to avoid

How to identify phishing attempts and social engineering

What to do if a device is lost or an account is compromised

How to escalate a suspected incident and who to contact

Keep it brief and practical. A one-page reference document is often more useful than a 30-slide deck.

Done properly, offshore hiring doesn’t weaken your data security posture. It just requires you to be deliberate about it. The firms that do this well treat it the same way they treat any new employee: structured access, clear expectations, and a short onboarding process that sets the standard from day one.

If you’re unsure where to start, ask us. We’ve placed staff into mortgage broking, accounting, financial planning and legal firms, and we can share what has worked for them. If you’re hiring for a role that handles client files every day, such as an offshore bookkeeper, start with the cloud desktop and access controls above. When you’re ready, book a 30-minute call.