Working with an overseas developer: draw the data map first
Identify what a remote supplier can see and use safer examples while planning a software project.
Sharing the production database is rarely the best first step in a software project. A remote developer may be able to understand the problem from sample records, screenshots with private details removed and a description of the workflow.
Faith Forge Labs works from the United States. If your Australian organisation is considering a project, discuss where information would be stored and who would be able to access it before providing customer or staff records.
List the information and the people
Make a short table with four columns: information, current system, proposed access and purpose. “Customer data” is too broad. Names and contact details, account history, health information, payment references and identification documents can raise different questions.
Include support access. An application hosted in Australia may still be accessed by people elsewhere. Conversely, a developer can sometimes build and test a feature using invented demonstration records without access to real records at all.
Get the right review
The OAIC's guidance on sending personal information overseas explains that overseas handling can require careful consideration. Whether a particular arrangement is a use or disclosure, and which obligations apply, depends on the facts. Ask a qualified adviser to review the proposed arrangement.
The practical contribution from your developer is a clear account of systems, locations, access, retention and deletion. Avoid accepting a vague promise that “the cloud is compliant”. Ask which service is involved, which configuration is proposed and who can change it.
Begin with a limited working environment
Use separate project accounts with only the access needed. Agree how access is removed when the engagement ends. Keep production changes separate from demonstrations, and decide who approves any use of real information in testing.
A short data map can prevent a late redesign and make adviser review more useful. Our integration planning includes information ownership and access decisions alongside the connection itself.