Is customer data safe with offshore staff? A practical security checklist

Customer data is as safe with someone in the Philippines as it is with anyone else on your team: it depends on the controls around them, not on where they sit. The controls that matter are the same in Manila as in Melbourne: their own login, only the access the job needs, two-step verification, a managed work device and access removed on their last day. What changes offshore is the privacy law on sending personal information overseas and the agreements you need with whoever employs them. This page gives you a checklist for both, with the official sources, as at October 2026.

What should be in place before they start?

Copy this checklist. Each item is explained in the sections below.

• Their own named login for every system. No shared accounts.
• Only the access the first responsibility needs; no admin rights.
• Payments, bank-detail changes and data exports kept with you unless deliberately delegated.
• Two-step verification on every account, using an authenticator app or passkey where offered.
• A password manager for any credential that genuinely has to be shared.
• A work device you or their employer own and manage: updates on, screen lock, disk encryption, remote lock and wipe.
• Written rules on where work data may and may not go (no personal email, personal chat apps or personal cloud storage).
• A confidentiality and data-processing clause in the agreement with whoever employs them.
• Your privacy policy checked for what it says about overseas access.
• A same-day offboarding list, written before day one.
• An access review in the diary every three months.

How much access should an offshore team member have?

As little as the work needs, under their own name. Individual logins mean every action can be traced to one person and switched off without affecting anyone else. Least-privilege access limits what a mistake, a phishing email or a stolen password can reach.

• Start narrow. Give access to the systems and folders for the first responsibility only, and add more as the role grows.
• No admin rights to your email, accounting or cloud platform unless the job is administering it.
• Separate the risky actions. Paying suppliers, changing a supplier's bank details, issuing refunds and exporting customer lists should need your approval. Emails announcing changed bank details are a well-known fraud, whoever processes them; confirm them by phone on a number you already hold.
• Review every three months and whenever responsibilities change: remove what's no longer used.

Is two-step verification enough, and do you need a password manager?

Two-step verification (MFA) is the single most useful control: a stolen password alone no longer gets anyone in. Turn it on for email, chat, accounting, your CRM and anything else holding customer data, and prefer an authenticator app or passkey to text-message codes. If you use a single sign-on such as Microsoft 365 or Google Workspace, enforce it there so every connected app inherits it.

A password manager covers the accounts that genuinely can't be individual, such as a supplier portal with one login. Share the credential through the manager, never by email or chat, and change it when anyone with access leaves. If we employ your team member, our own workspace, where they see their leave and timesheets, supports two-step verification with a passkey or an authenticator app.

Whose device should they use?

A work device owned and managed by you or their employer, not a personal laptop shared with the household. Whoever owns it, check that:

• operating system and browser updates install automatically;
• the screen locks after a few minutes and needs a password, PIN or biometric to open;
• the disk is encrypted (BitLocker on Windows, FileVault on a Mac);
• it can be located, locked and wiped remotely if it's lost or someone leaves;
• antivirus is on and nobody else uses the device; and
• you know who to call when it breaks, so a failed laptop doesn't become a personal one "just for today".

If we employ your team member, the laptop is ours and is connected to our remote management tool, so our IT team can see whether it's online and receives its alerts, such as a failing disk.

What should stay out of personal email and chat?

Everything to do with work. Most leaks are ordinary: a file forwarded to a personal address to work on at home, a customer's details sent in a personal messaging app, a screenshot pasted into the wrong chat. Put these rules in writing and explain why:

• no forwarding work email to personal accounts, and no automatic forwarding rules;
• no customer data in personal WhatsApp, Viber, Messenger or SMS; use your business chat;
• no work files in personal Google Drive, Dropbox or USB drives; use your business storage;
• no customer data pasted into AI tools or other apps you haven't approved; and
• no photos or screenshots of customer records outside your systems.

Make the right way the easy way: if they need to share something with a colleague, the business tool should be quicker than the personal one.

What should your agreements say?

Two agreements matter. The team member's employment contract should include confidentiality that continues after they leave. If an agency or employer of record employs them, your service agreement with that company should include a data-processing clause. Australia's privacy regulator says it generally expects an enforceable contract with an overseas recipient (APP guidelines, paragraph 8.16), and New Zealand's Privacy Commissioner publishes optional model clauses for overseas disclosures. A practical clause covers:

• what personal information is handled, and only for your purposes;
• the security measures expected, such as the ones on this page;
• a duty to tell you promptly about any suspected breach;
• return or deletion of your data when the arrangement ends;
• any subcontractors bound by the same terms; and
• compliance with your country's privacy principles.

What should happen on their last day?

Access ends the same day, ideally the same hour, whatever the reason for leaving. Keep this list ready:

• Disable their main account (email or single sign-on) and sign them out of every session.
• Remove them from each app that has its own login, chat groups and shared drives.
• Change any shared password they knew, and remove their phone or authenticator from shared MFA.
• Check for email forwarding rules and apps they connected to your accounts.
• Move ownership of their files, calendars and mailbox to their manager.
• Recover the device or lock and wipe it remotely.
• Record the date everything was removed.

What do New Zealand and Australian privacy laws require?

New Zealand. Information privacy principle 12 of the Privacy Act 2020 limits disclosing personal information outside New Zealand. You can only do it if a condition applies: for example, the recipient is subject to privacy laws or agreements that provide comparable safeguards, or the person has authorised it after being told their information may not get the same protection. Under section 11, information held by another organisation only as your agent is treated as held by you, so in most cases you stay responsible for it (Privacy Commissioner guidance). If a privacy breach has caused or is likely to cause serious harm, you must notify the Privacy Commissioner and affected people as soon as you practicably can.

Australia. If your business is covered by the Privacy Act 1988 (businesses with annual turnover of $3 million or less generally are not, unless an exception applies, such as health service providers; see the OAIC's small business guidance), Australian Privacy Principle 8 requires reasonable steps before disclosing personal information to an overseas recipient, and section 16C can make you accountable for the recipient's breaches. The APP 8 guidelines treat giving information to an overseas contractor as a disclosure in most cases, but handling that stays within your effective control can be a "use" instead. Your privacy policy must say whether you are likely to disclose personal information overseas and, where practicable, to which countries (APP 1.4(f) and (g)). A breach likely to cause serious harm must be notified to the OAIC and affected people.

When your team member works only in your systems, under your direction, how much control you keep and what your agreements say decide a lot. Take your exact arrangement to a privacy adviser.

Does the Philippines Data Privacy Act apply?

The Philippines' privacy law is the Data Privacy Act of 2012 (Republic Act No. 10173), administered by the National Privacy Commission. Three parts are worth knowing:

• Scope (section 4). The Act covers processing of personal information in the Philippines, but it does not apply to personal information originally collected from residents of other countries under their own laws while it is processed in the Philippines.
• Security (section 20). It requires reasonable organisational, physical and technical measures, and employees who process personal information must keep it confidential, a duty that continues after their employment ends.
• Accountability (section 21). An organisation stays responsible for personal information under its control, including information transferred to a third party for processing.

So for customer data you collected under New Zealand or Australian law, start with your own country's privacy law. The team member's own personal information, held by their employer in the Philippines, falls under the Philippine Act.

What should you do if something goes wrong?

Act first, then investigate. If a laptop is lost, a login looks wrong or you're worried about someone's conduct:

1. Disable the account or reset the password, and sign out all sessions.
2. Lock or wipe the device remotely.
3. Keep the evidence: sign-in logs, emails and dates.
4. Work out whose personal information was involved and whether serious harm is likely.
5. Notify the regulator and affected people if the law requires it (see above).
6. Tell whoever employs the team member, so they can follow their own process.

If you'd rather not run the employment and the devices yourself, an employer of record can; we are one, and access to your own systems stays yours to give and remove. You can ask us about your security requirements or read your first 90 days managing someone in the Philippines.

This guide is general information, not legal advice. Check your situation with a privacy adviser in your own country.