Data Sovereignty and the "Zero-Trust" Approach
For finance leaders, data security is the first question about offshoring. The answer is not a promise from the provider: it is knowing which rules apply and checking that the setup meets them.
The Rules That Apply
Three privacy regimes meet when an Australian or New Zealand firm sends finance work to the Philippines. This is a summary, not legal advice.
- Australia, APP 8: before personal information is disclosed to an overseas recipient, you must take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles, and you generally stay accountable if it does. See the OAIC guidelines on APP 8.
- New Zealand, IPP 12: under the Privacy Act 2020, personal information may go overseas only where the recipient is subject to comparable safeguards, or another ground in the principle applies. See the Privacy Commissioner on IPP 12.
- Philippines, Data Privacy Act of 2012: personal information processed in the Philippines is covered by the Act, overseen by the National Privacy Commission. See the National Privacy Commission.
Where the overseas party only handles information on your behalf and under your control, the guidance can treat it as your own use or holding rather than a disclosure. Check the regulator's guidance against your setup.
Registered tax and BAS agents in Australia have a further duty of confidentiality under the Code of Professional Conduct; see what the TPB requires when work goes offshore.
What OFP Does
The practices below are how OFP works in every engagement. The data stays in your systems; OFP controls the people, devices and access around it.
| Practice | What it means for your data |
|---|---|
| Work inside your systems | Your ledger, practice management and documents stay where they are. Data is processed, not extracted. |
| Individual accounts, role-based access | Each professional reaches only the systems and information their role needs. |
| VPN and multi-factor authentication | Access runs through a secure connection with a second factor on every login. |
| Managed devices | OFP supplies and controls the equipment the work is done on. |
| Confidentiality in the agreements | Confidentiality obligations are covered in our agreements. |
| Access removed at the end of an assignment | When a professional leaves your account, their access is removed immediately. |
OFP aligns this setup with your own security requirements. If your policy asks for more, it is agreed before the start date.
Who Stays Responsible
Outsourcing does not move your obligations. Our accountants work under your registration and your review:
- Australia: preparation under the supervision of your registered BAS or tax agent, who remains responsible for lodgement.
- New Zealand: preparation inside your IRD filing process; filing stays with your firm or your tax agent.
Questions to Ask Any Provider
Whoever you work with, these questions show whether the controls are real:
- Does the work happen inside our systems, or is data copied into yours?
- Does every person have an individual account, with multi-factor authentication?
- Who owns and manages the devices the work is done on?
- Where are the confidentiality obligations written down?
- How fast is access removed when someone leaves the account?
- Which privacy law applies where the work is done, and who oversees it?
Conclusion
A secure offshore setup is not about trusting a stranger; it is about knowing the rules and verifying the controls. Choose a managed model that keeps the work in your systems, and see our outsourced accounting services for Australia.
Start your team and bring your security requirements to the first conversation.