s 6(1) · APP 11
The provider holds it. You answer for it.
The OAIC says the entity stays responsible and accountable for the personal information it collects, even when a provider holds it. The ASD divides the security work between the provider and the customer. Both are true at once, and this guide holds them together.
General information about Australian privacy law, not legal advice. The OAIC’s guidance on accountability for personal information held by providers is at oaic.gov.au.
What the OAIC says
The OAIC’s line, in its own words: “Your entity is responsible and accountable for the personal information it collects, even when the information is held by external service providers or contractors operating in Australia or overseas.”
Where you still hold the information, the OAIC’s securing guidance says the reasonable steps can include robust management of the provider storing or handling it: effective contractual clauses, verifying the provider’s security claims through inspections, and regular reporting and monitoring.
What the ASD says
The ASD’s cloud guidance opens with the division of work: “Cloud security is a shared responsibility between cloud service providers (CSPs) and their customers.” Which side carries which part depends on the cloud service you use or plan to use, and the ASD asks customers to review that shared responsibility model for each service.
On the provider’s side of the line, the ASD puts the service itself: a provider “is responsible for providing cloud services that are securely designed, set up and operated”, including the security of the underlying infrastructure and of all third parties involved in providing them.
On your side, the ASD says: “As the customer, you will always have some responsibilities. You also carry the risk of your data being stolen, changed without your approval, or you losing access to it.” That can mean financial loss, reputational damage and legal issues, and the ASD’s words are that you “can’t outsource that risk to a CSP”.
Two of the ASD’s key actions sit on the same side: choose cloud service providers that provide security documentation and independent assurance, and review that shared responsibility model for each cloud service you use or plan to use. If a provider does not provide such documentation, the ASD says to consider choosing a different provider, and customers can ask for the provider’s IRAP assessment.
Shared work, unshared accountability
The two readings fit together as shared work and unshared accountability. The ASD splits the security work so that the provider carries the half it can carry, which for a cloud service is substantial: securely designed, set up and operated services, and the security of the third parties it uses.
The OAIC’s half does not split. The entity remains responsible and accountable for the personal information it collects, even when a provider holds it, and the customer carries the risk of the data being stolen, changed without approval, or of losing access to it.
So a provider can carry most of the security work and it changes nothing about the accountability. Where you outsource the handling to a third party, including a cloud service provider, and you continue to hold the information, the OAIC says you will still be subject to APP 11.
The ASD also warns where the split most often fails: responsibilities often overlap, and if you and the provider are unclear on who is responsible for what, “it can leave gaps in security”.
What stays yours, whatever the service
Two things the ASD and the ACSC single out on the customer’s side. Administrator access: “As the system administration processes and procedures implemented by service providers are often opaque to their customers, customers should consider a service provider’s control plane to operate within a different security domain.”
And logging: “The logging policy should take into consideration any shared responsibilities between service providers and the organisation.”
The OAIC’s access guidance carries the same weight: where the storage of personal information is outsourced but you still retain the right to deal with it, the duty to locate it for an access request extends to it.
The incident duties stay with you too. The OAIC’s securing guidance says that if you still hold the personal information, APP 11 applies, and you are subject to the Notifiable Data Breach scheme “even if it is the third party who suffers the eligible data breach”; both you and the provider may be subject to the scheme, and only one of you is required to notify individuals.
Where the asset is a critical infrastructure asset, the Act’s round starts with the customer: once it becomes aware that a data storage or processing service is provided to it on a commercial basis and relates to business critical data, it must take reasonable steps to inform the provider, as soon as practicable (s 12F(3)).