Australian businesses must clear 20 compliance checks before an offshore hire starts, across four areas: employment status and Fair Work, tax and superannuation, privacy and data security, and contract, IP and offboarding. Most are quick. The three that catch people out are classification under the Fair Work Act's whole-of-relationship test, Privacy Act accountability for what an overseas recipient does with your data, and permanent establishment risk. This article is general information, not legal advice on your arrangement.
In short
An Australian business must clear 20 compliance checks before an offshore hire starts, across employment status and Fair Work, tax and superannuation, privacy and data security, and contract, IP and offboarding. Three cause most of the damage: classification under the Fair Work Act's whole-of-relationship test in force since 26 August 2024, section 16C of the Privacy Act which keeps you accountable for what an overseas recipient does with your data, and permanent establishment risk. Misclassification penalties reach $93,900 for an individual and $469,500 for a company. An Employer of Record from $400 per month removes the engagement layer, but privacy, IP and access stay yours.
What does an Australian business actually have to verify?
You verify four things: that the person is engaged correctly where they work, that you are treating them correctly for tax, that your data stays protected when it crosses the border, and that the contract and the exit are watertight. Everything below sits under one of those four headings.
Two framing points before the list. First, hiring offshore is legal in Australia; the risk is in how the engagement is structured, not in the decision to hire. Second, and this is the one that trips up careful businesses, there is no single classification answer. The Fair Work Act, PAYG withholding and the superannuation guarantee each apply a different test, so a worker can land differently under each.
Work through the checklist before the person starts, not after. 34% of Australian businesses already use contractors or freelancers in some form (ABS and Employment Hero 2025, AU-13), and 58% of ANZ companies plan to increase offshore headcount in 2026 (MKT-04), so this is now routine compliance rather than an edge case.
Which employment and Fair Work items must you check?
Six, and the first is the one everything else rests on: establish and document where the work is physically performed. The Fair Work Act is built around work performed in Australia, so a professional working from Manila or Cape Town generally sits outside it, but that only holds if you can show it.
The bigger change is the test itself. Since 26 August 2024, section 15AA of the Fair Work Act requires the real substance, practical reality and true nature of the working relationship to be assessed as a whole, taking in control, financial risk, equipment, the right to delegate, hours and the expectation of continuing work, not just what the contract says. Section 15AB lets eligible individual contractors above the high income threshold, $190,100 from 1 July 2026, opt out of that test by written notice.
Checks 1 to 6: employment status and Fair Work
| # |
Verify |
Why it matters |
| 1 |
Where the work is physically performed, documented in the agreement and evidenced |
The Fair Work Act is built around work performed in Australia; the exemption only holds if you can show it |
| 2 |
The arrangement against the whole-of-relationship test |
Section 15AA, in force since 26 August 2024, looks at the real substance, practical reality and true nature of the relationship, not the contract label |
| 3 |
Control, financial risk, equipment, right to delegate, hours and expectation of ongoing work |
These are the specific factors weighed under section 15AA |
| 4 |
Whether the section 15AB opt-out applies |
Eligible individual contractors above the high income threshold, $190,100 from 1 July 2026, can opt out of the whole-of-relationship test by written notice |
| 5 |
Your sham contracting position and the file that supports it |
The section 357 defence turns on a reasonable belief the engagement was genuine at the time, so build the evidence at the start |
| 6 |
Compliance in the worker's own country |
Philippine or South African labour law governs the engagement, and misclassification there returns as back pay and benefits |
Sources: Fair Work Act 2009 ss 15AA, 15AB and 357 as amended by the Closing Loopholes reforms (commenced 26 August 2024); Fair Work high income threshold $190,100 from 1 July 2026; Fair Work Ombudsman (2025). General information only, not legal advice.
Get this wrong and it is expensive. The Fair Work Ombudsman investigates more than 12,000 Australian businesses for contractor misclassification each year (COM-02), with penalties reaching $93,900 for an individual and $469,500 for a company (Fair Work Ombudsman 2025, COM-01). The sham contracting defence now turns on whether you reasonably believed the engagement was genuine at the time, so the file you build at the start is the defence you get later.
What tax and superannuation items must you check?
Five, and the good news is that most resolve in your favour once documented. The ATO does not require superannuation guarantee for a non-resident employee who performs all their work outside Australia, and PAYG withholding generally does not apply to a non-resident contractor with no Australian-sourced income.
Do not over-extrapolate from that. An ABN does not settle contractor status, and a contractor paid mainly for their labour can still attract superannuation guarantee under the ATO's separate test. Australia also moves to Payday Super from 1 July 2026, so if you have any local staff alongside your offshore team, your contribution timing changes regardless.
Checks 7 to 11: tax, superannuation and payments
| # |
Verify |
Why it matters |
| 7 |
That no superannuation guarantee is payable |
The ATO does not require SG for a non-resident employee who performs all their work outside Australia |
| 8 |
That an ABN is not being treated as proof of contractor status |
An ABN settles nothing; a contractor paid mainly for their labour can still attract SG under the ATO's separate test |
| 9 |
PAYG withholding treatment and the documentation behind it |
Withholding generally does not apply to a non-resident contractor with no Australian-sourced income, but the position must be evidenced |
| 10 |
Permanent establishment exposure |
An offshore person with authority to conclude contracts, or a fixed place of business, can create a taxable presence in their country |
| 11 |
GST treatment of the imported service, and a clean payment trail |
Written agreement, invoices and evidence of where the work is done are what you produce if the ATO asks |
Sources: Australian Taxation Office guidance on working out if you have to pay super, and on PAYG withholding for foreign residents. Note that the Fair Work Act, PAYG withholding and the superannuation guarantee each apply a different classification test. Payday Super applies from 1 July 2026 for local staff. General information only, not tax advice.
The item most often missed is permanent establishment. If your offshore team member has authority to conclude contracts on your behalf, or operates a fixed place of business for you, you can create a taxable presence in their country. It is usually avoidable with a properly scoped role, but only if someone checks.
What privacy and data security items must you check?
Five, and one of them carries more legal weight than most Australian businesses realise. Australian Privacy Principle 8 requires you to take reasonable steps to ensure an overseas recipient does not breach the APPs before you disclose personal information to them, which in practice means an enforceable contract obliging them to handle it to Australian standards.
Then read section 16C of the Privacy Act, which is the part that matters: your organisation remains accountable for an act of the overseas recipient that would breach the APPs, even where you took reasonable steps. You cannot contract the liability away, so the controls have to be real.
Checks 12 to 16: privacy and data security
| # |
Verify |
Why it matters |
| 12 |
Reasonable steps under Australian Privacy Principle 8 before any personal information crosses the border |
In practice this means an enforceable contract requiring the overseas recipient to handle the information to APP standards |
| 13 |
That you understand section 16C accountability |
Your organisation stays accountable for an act of the overseas recipient that would breach the APPs, even where you took reasonable steps |
| 14 |
That your Notifiable Data Breaches response plan covers the offshore team |
The OAIC received 1,205 breach notifications in 2025, up 8%, and 716 came from malicious or criminal activity |
| 15 |
Scoped system access: least privilege, named accounts, no shared logins |
Access you cannot attribute to one person is access you cannot audit or revoke cleanly |
| 16 |
Two-factor authentication, VPN and a managed device or secure cloud workspace |
Keeps company data inside your perimeter rather than on a personal machine |
Sources: Privacy Act 1988 (Cth), Australian Privacy Principle 8 and section 16C; Office of the Australian Information Commissioner guidance on sending personal information overseas; OAIC Notifiable Data Breaches Report (2025). General information only, not legal advice.
The threat environment justifies the effort. The OAIC received 1,205 notifiable data breach notifications in 2025, up 8% on 2024, and 716 of those were caused by malicious or criminal activity rather than staff error (OAIC Notifiable Data Breaches Report 2025). 62% of businesses now require security certifications from their vendors (COM-06). Every Pear Tree placement is set up with VPN, two-factor authentication and compliant cloud workflows from day one (PT-08).
What contract, IP and offboarding items must you check?
Four, covering what you own, what stays confidential, what you have to disclose, and how the engagement ends. Intellectual property is the one to get right first, because an assignment clause that is unenforceable in the worker's jurisdiction protects nothing. The Philippines is a signatory to the major international IP treaties (IPOPHL and WIPO 2025, COM-07), which helps, but the clause still needs to be drafted for the governing law you have chosen.
Checks 17 to 20: contract, IP and offboarding
| # |
Verify |
Why it matters |
| 17 |
An IP assignment clause that is enforceable under the governing law you have chosen |
A clause that does not bite in the worker's jurisdiction protects nothing; the Philippines is a signatory to the major international IP treaties |
| 18 |
Confidentiality obligations that survive the end of the engagement |
Most of the risk sits after someone leaves, not while they are working for you |
| 19 |
Your modern slavery position |
Reporting is mandatory at $100 million annual consolidated revenue under the Modern Slavery Act 2018; below that, expect larger clients to ask anyway |
| 20 |
A documented offboarding process: access revoked on the last day, data returned or wiped, exit recorded |
The same discipline you would apply to a local employee, and the item most often skipped |
Sources: Modern Slavery Act 2018 (Cth) reporting threshold of AUD$100 million annual consolidated revenue; IPOPHL and WIPO (2025) on Philippine treaty membership; Pear Tree placement practice (2026). General information only, not legal advice.
Modern slavery reporting only becomes mandatory at $100 million in annual consolidated revenue under the Modern Slavery Act 2018, so it does not apply to most Pear Tree clients. It is still worth a position, because businesses above that threshold have to report on their supply chains, and if you sell to them you will be asked. A direct-hire model with transparent pay is a straightforward answer to that question.
Offboarding is the item people skip. Revoke access on the last day, recover or wipe data, and document it, exactly as you would for a local employee.
Who carries the risk if you get it wrong?
You do, in almost every case. That is the point worth internalising: the Fair Work exposure, the ATO position, the APP 8 obligation and the section 16C accountability all sit with the Australian business, not with the worker and not automatically with a provider.
This is where an Employer of Record or Contractor of Record changes the arithmetic. A compliant entity legally engages the person in their home country and carries the local tax, payroll and classification obligations, which removes the single largest item on the list. Pear Tree provides both from $400 per month per person (COM-04), and 43% of companies now use an EOR for offshore hires (Deel and Oyster HR 2025, MKT-09).
It does not remove everything. Your Privacy Act obligations, your IP position and your access controls stay yours regardless of who employs the person, which is an argument for a direct-hire model where the professional works inside your own systems rather than a shared agency environment.
The bottom line
Twenty checks, four categories, and one principle: the Australian business carries the risk, so the documentation you build before day one is the protection you get afterwards. Classification under the Fair Work whole-of-relationship test, section 16C accountability for offshore data handling, and permanent establishment are the three that cause real damage. An Employer of Record from $400 per month handles the engagement layer; the privacy, IP and access items stay with you.
Frequently asked questions
What must an Australian business verify before hiring offshore?
Twenty checks across four areas: employment status and Fair Work, tax and superannuation, privacy and data security, and contract, IP and offboarding. Start by documenting where the work is physically performed, because the Fair Work Act is built around work performed in Australia. Then test the arrangement against the whole-of-relationship test, confirm the superannuation and PAYG position with the ATO's separate tests, take reasonable steps under Australian Privacy Principle 8, and put an enforceable IP assignment and offboarding process in place.
Does the Fair Work Act apply to offshore workers?
Generally no, because the Fair Work Act is built around work performed in Australia, so a professional working from Manila or Cape Town usually sits outside it. That only holds if you can evidence where the work is done. Since 26 August 2024, section 15AA assesses the real substance, practical reality and true nature of the working relationship rather than the contract label, weighing control, financial risk, equipment, the right to delegate, hours and the expectation of ongoing work.
Do you pay superannuation for an offshore worker?
No. The ATO does not require superannuation guarantee for a non-resident employee who performs all their work outside Australia. Do not over-extrapolate from that, because an ABN does not settle contractor status and a contractor paid mainly for their labour can still attract superannuation guarantee under the ATO's separate test. The Fair Work Act, PAYG withholding and the superannuation guarantee each apply a different classification test, so a worker can land differently under each.
What does the Privacy Act require when offshore staff handle Australian data?
Australian Privacy Principle 8 requires you to take reasonable steps to ensure an overseas recipient does not breach the Australian Privacy Principles before you disclose personal information to them, which in practice means an enforceable contract holding them to APP standards. Section 16C then keeps your organisation accountable for an act of the overseas recipient that would breach the APPs, even where you took reasonable steps, so the liability cannot be contracted away and the controls have to be real.
What are the penalties for getting offshore classification wrong?
Fair Work penalties reach $93,900 for an individual and $469,500 for a company, and the Fair Work Ombudsman investigates more than 12,000 Australian businesses for contractor misclassification each year. On top of any penalty sits back pay, entitlements and unpaid superannuation. The sham contracting defence now turns on whether you reasonably believed the engagement was genuine at the time it was made, which is why the documentation you build before day one matters.
Does an Employer of Record remove all of these obligations?
No, it removes the largest one. An Employer of Record or Contractor of Record legally engages the person in their home country and carries the local tax, payroll and classification obligations, and Pear Tree provides both from $400 per month per person. Your Privacy Act obligations, your intellectual property position and your access controls stay with you regardless of who employs the person, which is an argument for a direct-hire model where the professional works inside your own systems.
AUTHOR BIO: Nick is Co-Founder of Pear Tree, a direct offshore talent placement company helping Australian and New Zealand businesses hire world-class Filipino and South African professionals without the agency markup. With offices in Sydney, Auckland, Cebu, Manila, Cape Town and Hawke's Bay, Pear Tree has placed talent with 750+ companies and maintains a 90% retention rate.
.png)
.png)
