The short answer: your data can be just as safe with a team member in Kuala Lumpur as with one in Brisbane, but it doesn't happen by default. Where someone sits doesn't decide whether your data is safe. What decides it is who controls the computer they use, the accounts they log in with, what they can reach, and what happens when they leave. Get those right and an offshore team member is no riskier than a local one. Get them wrong and a staff member down the hall is a risk too.
For Australian businesses this is more than good practice. If your business is covered by the Privacy Act, you stay responsible for the personal information your offshore team handles. Since 2025 Malaysia has also had tougher data protection rules of its own. This guide explains both in plain language, sets out the controls that matter, and gives you a checklist to use with CMX Co or any other provider.
This article is general information current as at 25 October 2026, not legal advice. Privacy and data protection obligations depend on your business, the information involved and your contracts. Get advice on your own circumstances.
Why "is it safe to hire offshore staff?" is the wrong question
It is the most common concern we hear from Australian business owners thinking about their first offshore hire, and it is a fair one. Most of the security material online is written by Philippines-based outsourcing companies and comes down to "trust us, we have firewalls". That doesn't help you judge an arrangement.
A better question is: whose controls is this person working under? There are broadly three models.
| Model | Whose systems and devices? | Your visibility and control |
|---|---|---|
| Freelancer or contractor on their own laptop | Theirs. Personal device, personal accounts, often shared with family | Low. You can't enforce updates or encryption, and you can't wipe the device when they finish |
| Outsourced service (BPO) | The provider's. Work often happens in the provider's systems, sometimes with your data copied across | Depends on the contract. You are relying on the provider's controls and audits |
| Dedicated team member working in your environment | Yours. They log into your Microsoft 365 or Google Workspace, on a managed device, under your security policies | High. The same controls, logging and offboarding as your Australian staff |
The third model is the one we recommend. Your data stays in your systems. You decide what the person can access, just as you would for a new starter in Australia. And because they are one of your team, not a ticket in someone else's queue, your security policies apply to them in the same way.
What does Australian privacy law require when offshore staff access personal information?
Does the Privacy Act apply to your business?
The Privacy Act 1988 and its Australian Privacy Principles (APPs) generally apply to businesses with annual turnover above $3 million. Some smaller businesses are covered regardless of turnover, including private health service providers, businesses that buy or sell personal information, and contracted service providers to the Australian Government. The OAIC explains who is covered.
Even if you are exempt, your clients may not be. Accounting firms, mortgage brokers, IT providers and professional services firms often have contracts that require them to protect client information to the same standard, wherever their staff work.
APP 8: sending personal information overseas
APP 8 deals with disclosing personal information to someone overseas. Before you do, you must take reasonable steps to make sure the overseas recipient doesn't breach the APPs. Usually that means a written, enforceable agreement. Under section 16C of the Act, if the overseas recipient then mishandles the information, you can be held responsible as if you had done it yourself.
Is a team member in Malaysia accessing your CRM a "disclosure"? The OAIC's APP 8 guidelines say giving personal information to an overseas contractor will usually be a disclosure. It can instead be treated as a "use" if a binding contract limits the contractor to your purposes and leaves you with effective control over how the information is handled. Either way, you remain accountable. So the practical answer is the same: keep the information in your systems, and have a written agreement with whoever employs your team member that covers confidentiality, security and what happens to your data.
APP 11: reasonable steps to protect information
APP 11 requires you to take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. Since the 2024 amendments, the APPs state expressly that those steps include technical and organisational measures. In practice that means the controls in the next section, plus training, policies and access reviews. The OAIC's APP 11 guidelines list them.
The Notifiable Data Breaches scheme still applies
If a breach happens through an offshore team member's account, the Notifiable Data Breaches scheme applies just as it would in Australia. If you suspect an eligible data breach, you must take all reasonable steps to complete an assessment within 30 days (section 26WH). If you conclude it is likely to cause serious harm, you must notify affected individuals and the OAIC. Your provider needs to tell you about incidents quickly enough for you to meet that timeline, so put it in the agreement.
Check your client contracts and industry rules
Some contracts and regulators restrict offshore access outright. For example, in 2026 the Department of Health issued Provider Notice 2026-1 to Hearing Services Program providers on third parties accessing client records from offshore. Government contracts, health, financial services and defence supply chains can all have these clauses. Read yours before you design an offshore role, not after.
What does Malaysian law add?
Malaysia's Personal Data Protection Act 2010 (PDPA) was substantially amended by the Personal Data Protection (Amendment) Act 2024, which came into force in stages during 2025. The changes Australian businesses should know about are:
- Data breach notification. Under the Commissioner's guideline, a data controller must notify the Personal Data Protection Commissioner within 72 hours of a breach that causes, or is likely to cause, significant harm. Affected individuals must generally be told within seven days after that notification.
- Data processors have direct obligations. A Malaysian company that processes personal data on someone else's behalf, such as an employer of record or service provider, is now directly bound by the PDPA's security principle.
- Data protection officers. Data controllers and processors above prescribed thresholds must appoint a data protection officer.
- Cross-border transfers. The old whitelist of approved countries has gone. Transfers out of Malaysia are now allowed under conditions explained in the Commissioner's April 2025 cross-border transfer guidelines.
The summaries above come from law-firm analysis of the amendments and the Commissioner's guidelines (see sources). Check the current text with the Personal Data Protection Department or a Malaysian lawyer before relying on any detail. The practical point is that Malaysia now has a breach notification regime and processor obligations of its own. A well-run Malaysian employer should be able to tell you how it meets them.
The controls that actually protect your data
None of these controls are special to offshore staff. They are what any well-run Australian business should have for every staff member. The Australian Signals Directorate's Essential Eight is a sensible baseline. Its eight strategies are application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups.
1. A company-managed computer
Your offshore team member should never work on a personal laptop. Use a device enrolled in your device management platform (for example, Microsoft Intune), with full-disk encryption, automatic updates, endpoint protection and the ability to lock or wipe it remotely. Whether that device is supplied by you or by your provider, it should be managed under your policies.
2. Their own named account, with strong MFA
Give them an individual account in your tenancy, never a shared login. Turn on multi-factor authentication, preferably phishing-resistant methods such as passkeys or authenticator app number matching rather than SMS codes.
3. Conditional access
Conditional access policies (in Microsoft Entra ID or similar) decide how someone can sign in, not only whether their password is right. A common rule is: access is allowed only from a compliant, company-managed device. Add location rules if they suit you, for example allowing sign-ins from Malaysia and Australia only. That way, a stolen password used from an unknown laptop gets nowhere.
4. Least privilege
Give access to the systems and folders the role needs, nothing more. An accounts receivable officer needs your accounting platform and the AR inbox, not the whole SharePoint, not payroll and not global admin. Review access whenever the role changes. This is where most businesses, onshore and offshore, quietly drift.
5. A password manager
Where shared credentials can't be avoided (some supplier portals still insist on them), store them in a business password manager, so passwords are never sent by email or chat and can be revoked centrally.
6. Data loss prevention that fits the role
Use sensitivity labels and data loss prevention policies to stop sensitive files being emailed externally, uploaded to personal cloud storage or copied to USB. Block personal email and file-sharing sites on the work device if the role doesn't need them. Keep it proportionate: the aim is to stop accidents and obvious misuse, not to make the job impossible.
7. Logging, not surveillance
Sign-in logs, audit logs and alerts for unusual activity are good security. Screenshot or keystroke monitoring software is a different matter. It tends to signal distrust, damages retention and does little against a determined bad actor. Malaysian candidates notice how an employer treats them, as Australians do. Manage by outcomes, and use security tooling for security.
8. Planned offboarding
Have a checklist ready before the first day: disable the account, revoke sessions and tokens, recover or wipe the device, rotate any shared credentials, and transfer mailbox and file ownership. With a dedicated team member in your environment, this works exactly like offboarding in Australia, because it is the same system.
Going further: keep the data off the device with Windows 365 or a secure browser
The controls above protect the computer your team member uses. For roles that handle highly sensitive information, such as identity documents, financial records, health information or client files under strict contracts, two technologies can go a step further. They keep your data from being stored on the device in the first place.
Windows 365 Cloud PCs
Windows 365 gives each person a full Windows desktop, called a Cloud PC, that runs in Microsoft's cloud and is streamed to whatever device they use. Your team member in Kuala Lumpur signs in and works in a desktop that sits in your Microsoft 365 environment and is managed in Intune like any other company computer. Their files, applications and browser sessions run in the Cloud PC, not on the laptop in front of them.
- You choose where the Cloud PC runs. Microsoft lists Australia East among the supported regions. That means the desktop, and the data being worked on, can stay in an Australian data centre while your team member works from Malaysia. That can make privacy and client contract conversations simpler, although you still need to think through APP 8 because a person overseas can see the information.
- Copying data out can be switched off. Clipboard, drive, USB and printer redirection between the Cloud PC and the physical device are disabled by default on new Cloud PCs, and you control them through Intune policy. Text and files can't simply be copied or saved to the local machine.
- A lost or failed laptop is a hardware problem, not a data breach. Because nothing is stored locally, a replacement device can be up and running quickly, and offboarding means switching off a Cloud PC rather than chasing a laptop.
- Plan for the trade-offs. Windows 365 is licensed per user per month and needs Intune and Microsoft Entra ID. It also relies on a stable internet connection. Kuala Lumpur's business-grade connectivity handles it well, but home connections should be tested before you commit.
Secure browsers and browser isolation
Many offshore roles happen almost entirely in a web browser: a CRM, an accounting platform, a ticketing system, Microsoft 365 on the web. For these roles, securing the browser can give much of the protection of a Cloud PC at lower cost.
- Session controls in Microsoft 365. With Microsoft Defender for Cloud Apps and Conditional Access, session policies can monitor web sessions and block downloads, uploads, copy and paste, or printing in real time, for example whenever a sensitive file is opened. Microsoft Edge applies these controls directly in the browser. Defender for Cloud Apps needs an E5-level licence or an add-on, so check what your current plan includes.
- Remote browser isolation. Services such as Cloudflare Browser Isolation run the web page on a remote server and send only a safe rendering to the user's screen. Policies can stop copying out, pasting in, downloading, uploading and printing, application by application. They also keep malicious websites away from the device itself.
- Enterprise browsers. A managed business browser applies data protection policies, such as which sites can be used, what can be copied and where files can be saved, without a full virtual desktop.
Which option suits which role?
| Approach | Best suited to | Things to weigh up |
|---|---|---|
| Managed laptop with the core controls | Most roles: admin, marketing, sales support, general finance | The baseline every offshore team member should have |
| Secure browser or browser isolation | Roles that work mostly in web applications and handle client or personal data | Lower cost than a full desktop, but only covers what happens in the browser |
| Windows 365 Cloud PC | Roles handling highly sensitive data, desktop applications, or clients and contracts that want data kept in Australia | Per-user licence and a reliable connection needed, but the strongest separation between your data and the physical device |
These aren't either-or choices. A common pattern is a managed laptop for everyday work, with sensitive systems reachable only through a Cloud PC or an isolated browser session enforced by Conditional Access.
Office or home: which is more secure?
Both can be secure, and both can be insecure. A managed office adds physical controls: building access, a business-grade network, and no family members walking past the screen. That suits roles handling identity documents, financial records or health information. A properly set-up home arrangement, with a managed device, conditional access and a private workspace, suits many other roles and is valued by employees.
Decide by the sensitivity of the information, not by habit. The deciding questions are: what information will this role see, who else could see the screen, and what network will the device connect through?
People are part of security too
Most breaches involve people being tricked, not systems being cracked. Three things make a real difference with offshore team members:
- Include them in your security training and phishing simulations, at the same time as your Australian staff. Leaving them out sends the wrong message and leaves a gap.
- Make it safe to report mistakes. A team member who clicked a bad link needs to feel able to say so straight away. In any culture, people are less likely to raise problems with a manager who reacts badly, so say clearly and often that early reporting is what you want. Our article on making your offshore team feel local covers building that kind of trust.
- Agree on verification habits. Payment changes, new supplier bank details and urgent requests "from the CEO" should always be verified through a second channel. This is exactly the work offshore finance and admin staff often do, so build the habit in from day one.
Checklist: questions to ask an offshore staffing provider about security
Use these with any provider, including us. A good provider will answer them directly and in writing.
- Who legally employs my team member, and where? Which entity will be handling my data, and under which country's law?
- Will they work in my systems or yours? Can they use my Microsoft 365 or Google tenancy, under my security policies?
- Who supplies and manages the computer? Can it be enrolled in my device management, or does it meet a standard my IT provider can verify? For sensitive roles, can you provide a Windows 365 Cloud PC or a secure browser so my data stays off the device?
- Where will they work? What are the physical and network controls in the office, and what is required for home working?
- What checks are done before hiring? References, qualifications, employment history, and any other background checks the role requires.
- What confidentiality and IP obligations do they sign? Are these in the employment contract, and do they survive termination?
- How will you tell me about a security incident, and how fast? Is that fast enough for me to meet my own Notifiable Data Breaches obligations?
- How do you meet Malaysia's PDPA? Including breach notification and, where required, a data protection officer.
- What happens on the last day? Who recovers the device, and how quickly is access removed?
- Can my IT provider work with you directly? If the answer is no, ask why.
If you are still deciding how to structure the hire, our guide to how to hire staff in Malaysia from Australia compares the options. Our guide to what it costs to employ someone in Malaysia includes equipment and security costs, which are easy to leave out of a budget.
How CMX Co fits
CMX Co was founded by people from both sides of this problem. Two of our founders come from IT and cyber security, and one from HR and recruitment. Your team member is employed by our Malaysian company, works only for your business, and can work from our Kuala Lumpur office or from home. All team members sign confidentiality agreements. We work with your existing IT provider so your team member works in your environment under your security standards, rather than us asking you to trust a separate set of systems.
Where a role needs more, CMX can provide Windows 365 Cloud PCs and secure browser or browser isolation solutions, or work with your current IT provider to help deploy them. That covers choosing the right option for the role, setting up Conditional Access and Intune policies, and testing it from our Kuala Lumpur office or the team member's home before they start.
When North Brisbane Mortgage Brokers brought on a mortgage administration and client support officer in Kuala Lumpur, the role involved identity documents and personal financial information. Role-appropriate access was set up from the start to meet the standards expected in a regulated financial services environment. You can read the North Brisbane Mortgage Brokers case study, or see our answer to how we approach data security in the FAQ.
Want to know how a Malaysian team member would fit your security setup?
Talk to CMX Co. We can walk through the role you have in mind, the information it would handle, and how device, access and offboarding would work with your IT provider, before you make a decision.
Sources: OAIC, Rights and responsibilities under the Privacy Act · OAIC, APP Guidelines Chapter 8: Cross-border disclosure of personal information · OAIC, APP Guidelines Chapter 11: Security of personal information · Privacy Act 1988, section 26WH · OAIC, Report a data breach · Department of Health, Hearing Services Program Provider Notice 2026-1 · Australian Signals Directorate, Essential Eight · Microsoft Learn, Windows 365 requirements and supported regions · Microsoft Learn, Manage RDP device redirections for Cloud PCs · Microsoft Learn, Defender for Cloud Apps session policies · Cloudflare, Browser Isolation policies · Personal Data Protection Department Malaysia · CMS, New guidelines on mandatory breach notifications under Malaysia's PDPA · ASEAN Briefing, Malaysia tightens data protection from June 2025 · Mayer Brown, Key amendments to Malaysia's PDPA and the cross-border transfer guidelines (July 2025)