Data Security & Compliance for Offshore Teams
How New Zealand and Australian businesses keep offshored data compliant, the NZ Privacy Act 2020 and the Australian Privacy Principles, explained plainly.
NexOutsource is certified to ISO/IEC 27001:2022
Proficient Customer Solutions (Fiji) Pte Ltd holds a current certificate of registration for its Information Security Management System, assessed against ISO/IEC 27001:2022, the current international standard for information security, cybersecurity and privacy protection.
Certified scope: management of information security for outsourced data management services, including but not limited to sales and marketing, customer support and journey management, payroll, finances, specialised technical support and back-office processing.
Certificate status can be verified independently with the certification body and through the IAF register. We provide the certificate of registration with any security questionnaire or tender response on request.
- Certificate holder: Proficient Customer Solutions (Fiji) Pte Ltd
- ISO/IEC 27001:2022
- Standard: ISO/IEC 27001:2022
- Certificate number: 250208056701
- Certification body: TNV System Certification
- Accreditation: International Accreditation Services (IAS), an IAF MLA signatory
- Certified site: Unit 18A, Floor 1, Garden City, Raiwai, Suva, Fiji
- Initial issue: 8 February 2025
- Valid until: 7 February 2028
- Surveillance audits: Annual, January
Can you legally offshore data to Fiji?
- Generally yes, when the right safeguards are in place.
- NZ Privacy Act 2020 (Information Privacy Principle 12)
- Australian Privacy Principles (APP 8)
- ISO/IEC 27001:2022 certified
How this maps to NZ and Australian privacy law
Privacy Act 2020, IPP 12
Information Privacy Principle 12 governs disclosing personal information to a recipient outside New Zealand. It is permitted where the overseas recipient is required to protect the information with safeguards comparable to the Act, for example through certification and contractual obligations. A provider with NZ-led management and clear data terms is built to meet this test.
Australian Privacy Principles, APP 8
APP 8 covers cross-border disclosure of personal information. The disclosing entity generally remains accountable for the overseas recipient's handling of the data, so it must take reasonable steps to ensure the recipient complies. Certified security controls plus contractual data-handling provisions are the practical way Australian businesses discharge that responsibility.
Send us your security questionnaire
We'll complete it from our existing security evidence pack and walk your team through our controls.
Compliance questions
Is it legal to send personal data to an offshore team in Fiji?
Generally yes, with appropriate safeguards. Under the NZ Privacy Act 2020 (IPP 12) you may disclose personal information overseas where the recipient has comparable safeguards; under the Australian Privacy Principles (APP 8) you remain accountable for the recipient's handling. A provider with contractual data terms and NZ-led management helps satisfy both. This is general information, not legal advice.
Does NexOutsource sign NDAs and data-processing agreements?
Yes. NexOutsource works under confidentiality and data-handling terms appropriate to each engagement, including NDAs and data-processing provisions, backed by ISO/IEC 27001:2022 certification.
Where is our data physically handled?
Work is performed in the NexOutsource-managed, access-controlled delivery centre in Suva, Fiji, on managed devices and a secured network, not from unmanaged home setups unless explicitly agreed and secured.
Can our security team review your controls before we sign?
Yes. We provide certification evidence and complete standard security questionnaires as part of onboarding. Start the conversation.
See your team, costed, in two minutes.
Build it in the calculator, then a thirty minute call turns it into a written quote. Live in 3 to 4 weeks.