App 8 and TPB Compliance When Outsourcing Client Work to India — Australian CPA Guide

What App 8 of the TPB Code Actually Requires

The Tax Agent Services Act 2009 (TASA) sets out the Code of Professional Conduct for registered tax agents and BAS agents in Schedule 1. Item 8 of the Code — commonly called App 8 — is the confidentiality obligation. It states that a registered tax practitioner must not disclose any information relating to a client's affairs to a third party without the client's consent, unless required or authorised by law.

When you share client bookkeeping files with an Indian bookkeeping firm, you are disclosing client information to a third party. App 8 does not prohibit this — it requires that you have the client's consent or that the disclosure is authorised. Your engagement letter disclosure, which notifies clients that work may be performed by offshore team members under your supervision, constitutes the client acknowledgement that satisfies this requirement. The engagement letter should be read as the client's consent mechanism under App 8.

The TPB has confirmed in practice guidance that engagement letter disclosure is sufficient where:

• The disclosure is made before work begins — not retrospectively
• The registered tax practitioner retains supervision and professional responsibility for all work
• The offshore provider is bound by a confidentiality agreement that mirrors the App 8 obligation
• The client has an opportunity to object before the engagement commences

The Privacy Act Obligations for Offshore Outsourcing

Separate from the TPB Code, the Privacy Act 1988 (as amended) imposes obligations on any Australian practice that discloses personal information to overseas recipients. Under Australian Privacy Principle 8 (APP 8), before disclosing personal information to an overseas recipient you must take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles in relation to the information.

This does not mean you need to audit the Indian firm's data security in person. It means you need a contractual data processing agreement that requires the Indian firm to handle personal data in accordance with Australian privacy standards, prohibits onward disclosure, and requires data deletion or return on termination of the engagement. A well-drafted data processing agreement (DPA) satisfies APP 8.

The 2022 Privacy Act amendments increased the maximum penalty for serious or repeated privacy breaches to A$50 million for organisations, and introduced individual penalties for officers of organisations in serious breach cases. This has made Privacy Act compliance for offshore outsourcing a material risk that practices need to address formally — not just rely on the Indian firm's goodwill.

Professional Indemnity Insurance: Does It Cover Offshore Work?

The short answer is: probably yes, but confirm it in writing before you start. Most standard PI insurance policies cover work performed under your practice's supervision regardless of where it is physically prepared — including by offshore teams. The key policy language to look for is whether coverage applies to "work prepared by or on behalf of the insured practice" vs "work prepared by employees of the insured practice." The broader formulation covers offshore supervised work; the narrower formulation may not.

Send a written question to your insurer: "Does my policy cover claims arising from work prepared by an offshore bookkeeping team in India under my practice's supervision and signed off by my practice before delivery to clients?" Get the answer in writing. If the policy has a geographic limitation that excludes offshore preparation, ask for an endorsement to remove it — this is typically a minor additional premium.

Note that the Indian firm's own PI insurance (if they hold it) covers their liability to you as their client — not your liability to your clients for errors in work delivered under your brand. Your PI insurance is the policy that matters for client-facing claims.

App 8 Compliance Checklist

Use this checklist before sharing any client data with an Indian bookkeeping firm. All items must be in place — there are no optional steps.

What the TPB Has Said About Offshore Outsourcing

The TPB has not issued a specific practice note prohibiting or restricting offshore outsourcing by registered tax practitioners. Its general guidance on subcontracting and the use of third parties confirms that registered practitioners may use third parties to assist with client work, provided they retain professional responsibility for the work and the client's confidentiality is protected.

The TPB's focus in this area is on situations where a practitioner uses offshore staff to lodge returns or provide tax advice without review — effectively delegating registered activities to an unregistered person. Bookkeeping, reconciliation, and BAS preparation workpapers are not registered tax agent services — they are support activities. The registered service is the BAS lodgement or tax return lodgement, which must be reviewed and authorised by the registered practitioner. The Indian team preparing the workpapers that support that lodgement is not providing a registered service, and their use does not require TPB authorisation.

For the related client disclosure obligations, see our full guide on how to tell clients you are using an offshore bookkeeping team. For the ATO's position on offshore bookkeeping from a tax compliance perspective, see our ATO compliance guide.

Frequently Asked Questions