Who this reaches
Australian Government agencies and many private-sector organisations, generally including organisations above the turnover threshold and specifically covered businesses such as private health providers.
What the rule requires
APP 8 creates duties around disclosure to overseas recipients and can preserve accountability for their handling. APP 11 requires reasonable security and, when information is no longer needed, reasonable destruction or de-identification steps.
What changes when the email path is regional
A project is fixed to Sydney and the regional plane is designed to own message content, recipients, queues, events, and provider state. Boundry documents known control-plane and operational exceptions instead of treating a sending-region selector as the whole answer.
What your team still owns
Boundry does not decide whether APP 8 applies to a particular transfer or replace the customer's privacy notices, purpose analysis, contracts, security program, or deletion duties.
Read the primary sources
This is an engineering and vendor-evaluation guide, not legal advice. Confirm the current rule for your entity, contract, and workload from the primary source.