The OAIC's report on the VIQ Solutions court-transcript incident shows that supplier risk is decided inside your suppliers' systems, not in your contracts.
On 4 November the OAIC published the findings of its preliminary inquiries into VIQ Solutions, the transcription provider whose handling of Federal Court recordings drew months of headlines. The incident turned out to be smaller than first reported. The lessons for businesses that rely on suppliers are bigger.
What actually happened
VIQ's Canadian parent company had a contract with e24 Technologies, a transcription business in India, for its global work. It inadvertently added e24 staff to VIQ's Australian transcription platform. Between September 2025 and February 2026, five e24 employees had access and three used it, working on hearing snippets from 93 Federal Court matters. The recordings stayed on Australian servers and couldn't be downloaded.
The OAIC found the Court's contract with VIQ was privacy-preserving. It banned offshore access to personal information without permission and required that only authorised personnel could reach the data. The OAIC put the root cause down to an access-control error, said there was a reasonable basis for concern about a breach of APP 11 (security of personal information), and decided against further action, largely because VIQ is now in liquidation.
A contract doesn't run your supplier's systems
For us, this is the important part. The Court did what good procurement says to do, and the clauses were there. They didn't stop someone in the supplier's wider group from adding people the Court had never dealt with to a shared platform.
A contract tells you what you can claim after something goes wrong. It doesn't tell you who can see your data today. Only evidence does that: who has access, how it's granted, and how often it's checked.
The slow part was getting the facts
The OAIC described getting the information it needed as "a challenging and protracted process", and the Federal Courts also faced delays getting facts from the supplier. A later independent review found the audio snippets were five minutes long, not the 15 minutes VIQ had reported.
If a supplier is slow, sold or in administration, your own incident response stalls with it. That's a real problem when you may have notifiable data breach obligations to assess.
The same questions apply to AI tools
Many businesses now use AI note-takers, transcription and chat tools whose vendors rely on parent companies and subprocessors of their own. The questions don't change: who in the vendor's group can see your data, and can they show you?
What to do now
Key points
- The OAIC found the Court's contract was sound; the failure was an access-control error inside the supplier's group.
- Contract clauses don't prove who can reach your data. Access reviews and logs do.
- Plan how you'll get incident facts from suppliers fast, including if they fail.
Need help applying this to your organisation? Talk to Cybervisory.