Yes. Neither Australia's Privacy Act nor New Zealand's Privacy Act bans an AI ATS from processing candidate data in Singapore. But the rules follow the data, not the server. Australian teams must take reasonable steps under APP 8 and stay accountable under section 16C. New Zealand teams must check IPP 12, especially when the vendor uses the data for its own purposes. HyreTech runs in Singapore, so the questions below apply to us too.
A region name on a vendor page is where the analysis starts, not where it ends. Both countries ask about control, contracts and purposes. Where the servers sit is only one input, and a Singapore data centre can be a sound choice or a gap depending on what surrounds it.
This article explains the overseas transfer rules in Australia and New Zealand, shows where candidate data goes in HyreTech as a worked example, and ends with eight questions you can send to any AI ATS vendor. It covers transfer only.
For Australia's separate rule on automated decisions, which starts on 10 December 2026, see AI hiring compliance in Singapore, Australia and New Zealand.
Checked against the primary sources on 14 October 2026. Privacy law in both countries is still changing, so check for updates after that date. This is a plain-language summary, not legal advice. Have counsel in each country review your vendor contract and candidate notices.
Hosted in Singapore Does Not Answer The Legal Question
A server location tells you where data sits. Australian and New Zealand privacy law ask something different: who controls the data once it leaves your hands, and what protection travels with it.
Neither law prohibits overseas processing. The OAIC's guidance on sending personal information overseas says the Privacy Act does not prevent you from using a cloud provider to store or process personal information overseas. You must still comply with the Australian Privacy Principles when you send it, as with any overseas outsourcing arrangement.
Recruitment is named in the guidance. The OAIC's APP 8 guidelines give the example of an Australian entity that, as part of a recruitment drive, passes job applicants' details to an overseas provider to run reference checks, and treat that as a disclosure. An AI ATS has the same shape. The vendor reads the resume and sends back an assessment.
Where Candidate Data Goes in HyreTech
HyreTech Pte. Ltd. is registered in Singapore, and its application and database run in Singapore. The table below follows sections 9 and 11 of HyreTech's privacy policy, which name the sub-processors and the international transfers.
| Step | What is sent | Where it is processed |
|---|---|---|
| Application and database (Google Cloud, Supabase) | Candidate profiles, resumes, scores | Singapore |
| Embeddings (Google Vertex AI) | Resume text, converted to numeric vectors | Singapore |
| AI inference (OpenRouter, routing to an upstream model provider) | Resume text and prompts built from it, and page images of scanned CVs | Not fixed. The upstream provider's region varies |
| LLM traces (Langfuse) | Prompt and response traces, which include resume text for CVs in your workspace | EU (Ireland) |
| Product analytics and support chat (PostHog) | Usage events, workspace user details, support messages | EU |
| Error tracking, payments, team notifications (Sentry, Stripe, Slack) | Diagnostics without request bodies, billing identifiers, support messages | United States |
| Email delivery (Mailjet) | Name, email, matched roles, and which of each role's requirements the candidate meets, for role recommendation emails | Not stated in the transfer section |
Two points shape the legal analysis. First, resume text does not stay in one country. It reaches an AI inference provider whose region is not fixed, and traces that contain it sit in Ireland.
Second, HyreTech acts as a data processor on a client's documented instructions for workspace data. It acts as a controller for the free resume screener and for role recommendation emails, and as a joint controller for talent pool pages hosted on HyreTech. That split matters under both laws, as the next sections show.
The Singapore page says plainly that not every sub-processor is in Singapore, that the region is not a data-residency guarantee, and that HyreTech makes no claim about its AI inference provider's own practices. Business clients can request a Data Processing Agreement from privacy@hyretech.ai.
Australia: APP 8, Section 16C and Reasonable Steps
Does The Privacy Act Cover Your Business?
Start one step earlier. According to the OAIC's small business guidance, most businesses with an annual turnover of A$3 million or less are not covered. Some are covered regardless of turnover, including a business that trades in personal information, which the OAIC describes as disclosing it for a benefit, service or advantage. A recruitment firm that passes candidate details to clients for a fee should check that test with counsel before assuming it is exempt.
The employee records exemption does not help with candidates either. The OAIC says it does not apply to personal information about prospective employees who are not hired, such as unsuccessful job applicants.
Use or Disclosure
The OAIC separates a "use" from a "disclosure" by one test: whether you keep effective control after the data is handed over. Per the APP 8 guidelines, sending data to an overseas cloud provider purely for storage can be a use, but only with a binding contract that limits the provider to that purpose, binds its subcontractors the same way and leaves you in effective control.
An AI ATS does more than store. It reads resume text and produces scores. Plan on the basis that sending candidate data to one is a disclosure, unless your counsel concludes otherwise. The contract terms decide it, not the vendor's marketing.
Accountability Stays with You
If APP 8.1 applies, you must take reasonable steps to ensure the overseas recipient does not breach the APPs. Under section 16C you are also accountable for the recipient's acts that would breach them.
The OAIC's guidance on sending personal information overseas says that applies even if you took reasonable steps, if a subcontractor breaches the APPs, or if the recipient breaches them by accident. When it resolves a matter under section 16C, the OAIC will take account of the reasonable steps you took.
What Reasonable Steps Look Like
The OAIC generally expects an enforceable contract. The APP 8 guidelines list what it may cover: the types of information and the purpose of disclosure, compliance with the APPs including by subcontractors, a complaint handling process, and a data breach response plan that includes notifying you.
How far you go depends on the sensitivity of the information, your relationship with the recipient, the possible harm to the individual, the recipient's safeguards and the practicality of the steps.
The Exceptions That Matter for Hiring
| Exception | What it requires | Practical read for an AI ATS |
|---|---|---|
| Substantially similar law or binding scheme (APP 8.2(a)) | You reasonably believe the recipient is bound by such a law or scheme and individuals can access an enforcement mechanism | The OAIC keeps no list of qualifying countries, so you must be able to justify your own belief |
| Prescribed country or binding scheme (APP 8.2(aa)) | The recipient is covered by a law or scheme prescribed in regulations | In force since 11 December 2024, but nothing had been prescribed when we checked the Privacy Regulations 2025 in October 2026, so you cannot rely on it yet |
| Consent after being expressly informed (APP 8.2(b)) | You tell the individual that APP 8.1 will not apply, that you will not be accountable and that they cannot seek redress under the Act | Consent must be voluntary, which is hard to show when applying is the only way forward |
| Required or authorised by Australian law (APP 8.2(c)) | An Australian law or court or tribunal order, not a foreign one | Covers specific legal requirements, not routine vendor use |
The other exceptions in the OAIC's chapter 8 are limited to agencies or to situations such as threats to life, so they do not help a private employer choosing a vendor.
Tell Candidates
The OAIC also points to APP 1.4 and APP 5.2 in its overseas transfer guidance. Your privacy policy and your collection notice must say whether you are likely to disclose personal information overseas and, where practicable, to which countries. A careers page that says nothing about an overseas AI ATS is a gap even when your contract is solid.
New Zealand: IPP 12 and the agent rule
Who The Act Covers
The Privacy Act 2020 applies to businesses and organisations, which it calls agencies. IPP 12 itself assumes that some overseas recipients are subject to the Act, because one ground covers a recipient carrying on business in New Zealand. Ask any vendor whether it considers itself covered.
When IPP 12 Applies
IPP 12 applies when you disclose personal information to a foreign person or entity in reliance on IPP 11(1)(a), (c), (e), (f), (h) or (i). You may do so only if one of the grounds in the table is met.
| Ground | Plain meaning |
|---|---|
| (a) Authorisation | The individual authorises it after being expressly told the recipient may not have to protect it comparably |
| (b) Carrying on business in NZ | You believe on reasonable grounds the recipient is subject to the Act |
| (c) Comparable laws | You believe on reasonable grounds the recipient is subject to privacy laws that overall provide comparable safeguards |
| (d) Prescribed binding scheme | The recipient participates in a scheme specified in regulations |
| (e) Prescribed country | The recipient is subject to the privacy laws of a country specified in regulations |
| (f) Agreement or other grounds | You believe on reasonable grounds the recipient is required to protect the information comparably, for example under an agreement |
The OPC's IPP 12 page listed no prescribed scheme or country when we checked in October 2026, so grounds (d) and (e) are not available in practice yet.
The Agent Rule
The OPC's guidance on sending information overseas explains that under section 11, when an agency holds information as an agent for another agency, for safe custody or processing, the information is treated as held by the agency that engaged it. Asked whether you need model clauses with an overseas cloud provider, the OPC answers "in most circumstances, no", because you remain responsible for the information you put in the cloud.
The exception is important. If the provider uses or discloses the information for its own purposes, both agencies are treated as holding it. For an AI ATS, workspace data processed on your instructions fits the agent scenario. Flows where the vendor uses candidate data for its own purposes do not fit as neatly.
In HyreTech those are role recommendation emails and talent pool pages. If candidates from your workspace can reach those flows, ask counsel whether IPP 12 applies.
When it does apply, the same OPC page says a written agreement is one practical route and points to its Model Contract Clauses Agreement Builder. It also notes that if a recipient will not agree to safeguards, you may need to review what you disclose.
Tell Candidates About Indirect Collection
Since May 2026, IPP 3A requires an agency that collects personal information from someone other than the person to take reasonable steps to tell them, unless an exception applies. In hiring that covers a CV forwarded by another recruiter or a referee's comments. The duty sits with the agency that collects the information, and information your ATS holds as your agent is treated as held by you, so the notice stays your job.
Eight Questions to Ask Any AI ATS Vendor
General procurement questions are in our buyer's checklist for AI recruitment software and the security review guide. These eight are the ones APP 8 and IPP 12 add.
| Question | Why it matters | Where HyreTech's answer sits |
|---|---|---|
| Where do the database and application run? | Starting point for APP 8 and IPP 12 | Singapore, see the Singapore page |
| Which sub-processors see resume text, and in which countries? | Section 16C covers subcontractors, and the OAIC expects them to be bound | Privacy policy, sections 9 and 11 |
| Are you our processor, or do you use candidate data for your own purposes? | Decides use or disclosure in Australia, and the agent rule in New Zealand | Privacy policy, sections 1 to 4 |
| Will you contact our candidates directly, and on what basis? | Direct contact is use for the vendor's own purposes, which takes that flow outside the agent rule | Role recommendation emails, sent as a controller (privacy policy, section 4) |
| Will you sign a contract with the terms the OAIC lists? | An enforceable contract is the expected reasonable step | A Data Processing Agreement is available on request |
| How are access, correction and deletion requests handled? | Both laws give individuals these rights | Responses within 30 days, or any shorter period the law requires. Requests about workspace candidate data are forwarded to the client. Deletion requests are actioned within 30 days of a verified request. Candidate data is not yet deleted automatically after a fixed period, so the retention period is yours to set |
| Will you tell us about a suspected breach, and how fast? | The OAIC lists a breach response plan as contract content | The policy commits to notifying authorities and affected individuals as required by law. Agree the timeline in the DPA |
| Do you consider yourself subject to the Australian or New Zealand Privacy Act? | APP 8 accountability and IPP 12(b) | The policy names the PDPA as the primary regime and does not mention either Act, so ask in writing |
To see what resume text an AI ATS actually reads, see how AI candidate matching builds a score.
What Singapore Hosting Does and Does Not Settle
Singapore hosting gives you one clear jurisdiction for the primary system and a vendor with a public company registration. The HyreTech Singapore page lists the UEN, address and region so a buyer can check them without a call. For the Singapore side of the law, see our PDPA and AI hiring guide.
It does not offer data residency in Australia or New Zealand, and HyreTech says plainly that it is not a residency guarantee. It also does not move your responsibility to the vendor. Have counsel review your vendor contract and candidate notices in each country.
Check Your Own Setup
If you want to see what the AI ATS reads before you write your notice, Start free and read the reasoning on a real role.
If you hire in Australia or New Zealand and need your counsel to see the data flow, Book a demo and we will walk through where each step runs.
FAQ
Can an Australian recruitment firm use an AI ATS hosted in Singapore?
Yes. The Privacy Act does not ban overseas processing, but if your firm is covered, APP 8.1 and section 16C apply when candidate data reaches the vendor. A firm with turnover of A$3 million or less can still be covered, for example if it discloses candidate details for a fee. HyreTech runs its application and database in Singapore and does not offer hosting in Australia or New Zealand. Ask any vendor which sub-processors see resume text and where, whether it uses candidate data for its own purposes, and for a Data Processing Agreement.
Can Australian candidate data be stored overseas?
Yes. The OAIC says the Privacy Act does not prevent overseas cloud storage or processing. You must take reasonable steps under APP 8.1, and you remain accountable under section 16C if the overseas recipient breaches the APPs, although the OAIC takes the steps you took into account.
What are the exceptions to APP 8?
For a private employer, the usable ones are a substantially similar law or binding scheme, consent after the individual is expressly informed, and disclosure required or authorised by Australian law. A newer exception for prescribed countries and schemes has been in force since 11 December 2024, but nothing had been prescribed when we checked in October 2026. The remaining exceptions apply only to agencies or specific emergencies, as set out in the OAIC's APP 8 guidelines.
Who does the New Zealand Privacy Act apply to?
It applies to businesses and organisations, which the Act calls agencies. Overseas organisations can also be covered, since IPP 12 refers to a recipient carrying on business in New Zealand that is subject to the Act. Confirm the exact reach with counsel.
Does IPP 12 apply when I use an overseas AI ATS to store and process candidate data?
Often not. The OPC says that when an agent holds or processes information for you, you generally remain responsible and the transfer is not treated as a disclosure under IPP 12. If the vendor uses the data for its own purposes, such as contacting your candidates directly, ask counsel to analyse that flow.
Does hosting in Singapore make an AI ATS compliant for Australian or New Zealand candidates?
No. Hosting location is one input. Compliance in both countries depends on your contract, the vendor's sub-processors and purposes, and your notices to candidates.
Do Australian candidates have to consent to an overseas AI ATS?
Not by default. Consent is only one exception to APP 8, and it requires you to tell candidates that you will not be accountable under the Act. The OAIC generally expects an enforceable contract and reasonable steps, plus a statement about likely overseas disclosures in your privacy policy and collection notice.