Australia is the location. The workload decides the rules.

Scope. Australian Government agencies and many private-sector organisations, generally including organisations above the turnover threshold and specifically covered businesses such as private health providers.

Requirement. APP 8 creates duties around disclosure to overseas recipients and can preserve accountability for their handling. APP 11 requires reasonable security and, when information is no longer needed, reasonable destruction or de-identification steps.

How Boundry changes the path. A project is fixed to Sydney and the regional plane is designed to own message content, recipients, queues, events, and provider state. Boundry documents known control-plane and operational exceptions instead of treating a sending-region selector as the whole answer.

Your remaining work. Boundry does not decide whether APP 8 applies to a particular transfer or replace the customer's privacy notices, purpose analysis, contracts, security program, or deletion duties.

Scope. Entities already covered by Privacy Act security obligations, including Australian Government agencies, many larger organisations, and specifically covered entities such as private health providers.

Requirement. An eligible breach generally involves unauthorised access, disclosure, or loss that is likely to cause serious harm and has not been neutralised by remedial action. Covered entities must assess and, where required, notify affected people and the OAIC.

How Boundry changes the path. Keeping the communication plane and its operational records together in one defined region can make the affected data classes and event trail easier to identify during an assessment.

Your remaining work. Boundry is one service provider in the response chain. The customer still owns its breach-response plan, legal threshold decision, multi-vendor investigation, and notifications.

Scope. The System Operator and specified registered repository, portal, and contracted service providers that hold records for the My Health Record system or access information relating to those records.

Requirement. Section 77 restricts covered participants from holding or taking relevant records outside Australia and from processing or handling related information outside Australia, subject to the Act's terms and limited exceptions.

How Boundry changes the path. Boundry offers a Sydney regional email plane that can be assessed when a notification workflow must avoid adding an offshore messaging path. Sensitive record content should still be minimised and kept behind an authenticated application boundary.

Your remaining work. Boundry does not claim registration as a My Health Record operator or automatic compliance with the Act. Do not place My Health Record information into email without a specific legal and architecture assessment.

Scope. State and territory public-sector agencies under their local regimes. Private health providers in NSW, Victoria, and the ACT can face both federal and local health-privacy requirements.

Requirement. The applicable principles vary across collection, security, use, disclosure, access, retention, and transborder flows. Western Australia's new public-sector privacy framework commenced in July 2026.

How Boundry changes the path. A common Sydney communication plane gives multi-state teams one provider data path to document, while the regional regulation map identifies where local legal analysis still needs to branch.

Your remaining work. One infrastructure region does not harmonise state laws or determine which regulator, health principle, retention period, or public-record rule applies.

Scope. APRA-regulated banks, insurers, private health insurers, and superannuation entities when managing operational risk and material service-provider arrangements.

Requirement. Regulated entities must identify and manage material arrangements, maintain appropriate agreements and oversight, and notify APRA before entering or materially changing a material offshoring arrangement.

How Boundry changes the path. A defined Australian processing path can reduce ambiguity in the offshoring assessment and give vendor-risk teams a narrower architecture, service location, and subprocessor surface to review.

Your remaining work. Boundry cannot determine materiality, critical-operation impact, APRA notification duties, or whether the customer's wider arrangement remains offshore through other services or personnel.

Scope. APRA-regulated entities and the information assets they manage directly or through related parties and third parties.

Requirement. Entities must maintain information-security capability and controls proportionate to threats and asset sensitivity, test control effectiveness, evaluate relevant third-party controls, and notify APRA of material incidents.

How Boundry changes the path. Boundry's architecture and planned Region Manifest are structured around the data classes a third-party review asks about: content, metadata, queues, events, logs, support, subprocessors, retention, and exceptions.

Your remaining work. Boundry is not 'CPS 234 certified'. The regulated entity remains responsible for classifying the asset, evaluating Boundry's controls, testing reliance, and governing the complete service chain.

Scope. Accredited persons, accredited data recipients, data holders, and outsourced service-provider arrangements handling CDR data under the CDR framework.

Requirement. Privacy Safeguard 8 restricts overseas disclosure of CDR data unless an exception applies. CDR outsourcing arrangements also bring specific consent, use, disclosure, security, deletion, and chain-of-provider requirements.

How Boundry changes the path. A Sydney email plane may remove an unnecessary overseas messaging provider from a CDR-adjacent notification workflow and make the remaining outsourcing chain easier to enumerate.

Your remaining work. Boundry does not claim CDR accreditation or that every use of its API forms a compliant CDR outsourcing arrangement. Do not send CDR data until the role, contract, consent, disclosure, and deletion design is reviewed.

Scope. Responsible entities and direct-interest holders for critical infrastructure assets, with additional obligations for specified data-storage and processing arrangements and Systems of National Significance.

Requirement. Relevant entities may need to provide register information, report cyber incidents, maintain a critical-infrastructure risk-management program, and notify data-service providers when they process business-critical data for an asset.

How Boundry changes the path. A discrete regional messaging path helps an operator enumerate the provider, region, message data, and event path for communication workloads connected to a critical operation.

Your remaining work. Boundry does not determine whether an asset or dataset is covered, operate the customer's risk program, or satisfy incident and register obligations for the broader critical-infrastructure system.

Scope. Commonwealth entities and suppliers handling government information, according to the relevant entity's classification, risk assessment, procurement, PSPF, ISM, and authorisation requirements.

Requirement. Government cloud consumers assess whether a service is suitable to store, process, and communicate the intended data. The assessment considers classification, architecture, controls, provider access, contractual requirements, and independent assurance such as IRAP where required.

How Boundry changes the path. Boundry can provide an Australian regional architecture and a data-path account that a government supplier can include in its own cloud and vendor assessment.

Your remaining work. Boundry is not IRAP assessed and does not claim Australian Government certification. The customer must obtain the authorisation and assurance required for its information and contract.

Scope. Senders of commercial electronic messages with an Australian link. Whether a message is commercial depends on its content and purpose, not the name of the email product used to send it.

Requirement. Commercial messages generally require consent, accurate sender identification and contact details, and a functional unsubscribe mechanism. The sender remains responsible when another provider sends on its behalf.

How Boundry changes the path. Boundry provides transactional delivery primitives and regional suppression/event data that can form part of the customer's messaging controls.

Your remaining work. Boundry does not infer consent, decide whether content is commercial, author the required sender information, or operate the customer's complete unsubscribe and marketing-governance process.