The WA Privacy Reset 1 min read

The best way to handle overseas-data consent? Never send it overseas.

Most teams are preparing to ask clients for consent to send data offshore. The sharper question is why it is leaving at all.

IPP 9 of WA’s new Act restricts disclosing personal information outside Australia. The usual response is to build a consent mechanism: a clause, a checkbox, a form that asks the individual to agree to their data leaving the country. It is lawful, but it is fragile. Consent can be refused, withdrawn, or later challenged as not genuinely informed, and every one of those outcomes lands back on you.

There is a cleaner path. If personal information never leaves Australia, the overseas-disclosure obligation is not required, and the consent question never arises. The exposure is not reduced; it is designed out. This is not a loophole. It is the outcome the principle is built to encourage.

The practical test is where your tools actually process and store data. Many consumer-grade platforms route audio, transcripts, and documents through offshore servers by default, which is precisely what puts you back in IPP 9 territory. Before you draft another consent clause, ask your vendors one question: does our data stay in Australia, end to end? If the answer is yes, the consent problem was never yours to solve.
This article is part of a short-read series collaboration by Nguma Pty Ltd and Onpoint 365 on Australian Government hiring.
About Nguma

AI interview management and transcription built for Australian Government compliance.

Nguma automates APS interview scribing, Selection Reports, and meeting transcription. Everything processed onshore in Australia. No AI decision-making. Full audit trail for Merit Protection review. 51% Indigenous-owned.

Learn about Nguma →