The disclosure of personal information abroad can only occur when the data sender ensures that the recipient will respect the requirements of the APP by entering into an enforceable contract with the foreign entity. However, there is no need for such a contract where the data sender reasonably believes that the overseas recipient is subject to a law, or binding scheme, that has the effect of protecting the information in a way that, overall, is at least substantially similar to the way the information is protected under Australian law. The determination of this condition is done by the data senders themselves, who must “reasonably believe” that the laws applicable to the recipient provide substantially similar protection to the one listed in the APP.  