EU law says that it's only legal to transfer personal data to companies that have adequate level of protection for personal data. Certain countries are considered to meet the adequacy requirement, but Australia is not one of them[1], so you probably need to meet the requirement using a contract[2]. You should probably consult a lawyer.

[1]: https://ec.europa.eu/info/law/law-topic/data-protection/data...

> The European Commission has so far recognised Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and the US (limited to the Privacy Shield framework) as providing adequate protection.

[2]: https://ec.europa.eu/info/law/law-topic/data-protection/data...