A couple emails after booking. They’ve read about data breaches in the news and want to know where their wedding photos will be stored and who will see them. You use an editor overseas, you’ve never mentioned it, and you’re not sure whether you were supposed to. Then you start reading about the Privacy Act and APP 8, and an hour later you’re less sure, not more.
This post explains, in plain terms, what the law asks of a photographer who sends client images to an editor outside Australia, where the small business exemption fits in, and what good practice looks like either way. It isn’t legal advice. Your lawyer is the right person for your own situation.
First question: are you covered at all?
The Privacy Act 1988 doesn’t apply to every business. The Office of the Australian Information Commissioner (OAIC) explains that most businesses with an annual turnover of A$3 million or less are not covered. That may include your studio.
There are exceptions. The OAIC lists businesses that are covered regardless of turnover, including health service providers and businesses that trade in personal information. There are others, so read the OAIC’s small business guidance in full rather than assuming you are exempt.
Two cautions:
- This is how the law stood when we researched it, in October 2026. Reform proposals would remove the small business exemption. We couldn’t confirm whether that has passed, so check the OAIC website for the current position before relying on it.
- Being exempt doesn’t mean couples don’t care. Their wedding photos show them, their families and their guests, sometimes children. The questions they ask are the same whether or not the Act covers you.
APP 8 in plain English
If the Act does cover you, the relevant rule is Australian Privacy Principle 8, which deals with cross-border disclosure. According to the OAIC’s APP guidelines, before you disclose personal information to an overseas recipient, you must take reasonable steps to make sure that recipient doesn’t breach the Australian Privacy Principles in how it handles that information.
Wedding photos and films are generally treated as personal information, because they show identifiable people, and briefs often include names. Sending them to an editor overseas is a disclosure to an overseas recipient.
Section 16C of the Act adds the part that matters most. In general, if the overseas recipient does something with the information that would breach the APPs, the Australian organisation that sent it can be held accountable as if it had done so itself. In other words, you can’t hand the responsibility on with the files.
What “reasonable steps” look like depends on the situation. A written agreement with the overseas recipient about how it handles the information is the usual starting point. Read chapter 8 of the OAIC’s APP guidelines for the detail and the exceptions.
What that means in practice for a photographer
Put simply, the law, where it applies, asks you to:
- Know who has the files. Which business, in which country, and who in it can open them.
- Have it in writing. A contract or data processing agreement that limits what the editor can do with the images: edit and deliver, nothing else.
- Keep control. You decide what is sent, how long the editor keeps it and when it is deleted.
- Be open with couples. It’s sensible for your privacy notice to say that images may be handled by service providers overseas.
None of this is unusual. Most of it is what you would want from an editor anyway.
Good practice, whether or not the Act covers you
Even if the small business exemption covers you today, these are worth doing:
A line in your client contract or privacy notice. Something like: “Your images may be edited by a trusted editing partner outside Australia. They are used only to edit your gallery and film and are deleted once the work is complete.” Adapt it with your lawyer to fit your business.
Send a link, not a hard drive. Keep the raws in your own Dropbox, Google Drive or similar account, and share a link for the project. You can close the link when the project is done.
Send only what’s needed. The editor needs the images, your preset and your references. They usually don’t need the couple’s surname, address or phone number. A first name in the brief is enough.
Ask about deletion. When are working copies deleted? Who can open the files while the project runs?
How we work with your files
These are the facts of how BackstagePost handles images. They are not a claim that your arrangement with us meets the Act. That depends on your business.
- Our team is in Pakistan. The files are accessed there, by the people working on your project.
- Your raws stay in your storage. You paste a Dropbox, Google Drive, WeTransfer, pCloud or Box link. Nothing is uploaded to our storage.
- Only on your instructions. We use your clients’ images only to edit and deliver the project and make the revisions you ask for. Never for our portfolio or marketing without your written permission, and we never contact your couples.
- Working copies are deleted once the project and its revisions are finished, unless you ask us to keep them.
- If something goes wrong, we tell you without undue delay, with what we know, so you can meet your own duties.
- Subprocessors are listed, and we update the list if a provider that handles your clients’ images changes.
All of this is set out in our data processing terms. If your studio needs a signed data processing agreement, ask and we’ll send one. Our confidentiality page covers white-label delivery, and our privacy policy covers data about your studio itself.
Questions to ask any editor, here or overseas
Whoever you use, these questions are fair:
- Where is your team, and who can open my files?
- Will you sign a data processing agreement?
- Do you download the files, and when do you delete them?
- Do you use client images in your own portfolio or marketing?
- Which other providers handle the files?
- What happens if there is a breach?
A good editor answers all of them plainly.
Not legal advice
This post describes the law in general terms, as the OAIC explains it, so you know what to ask about. It isn’t advice about your business. If you’re unsure whether the Act covers you, or what your contract should say, speak to a lawyer who works with small businesses.
Next step
If the way we handle files suits your studio, try us on one project. Your first Gallery or Highlight project is free, with no card.
For the practical side of working with a team overseas, read working with an editing team behind your time zone.