Compliance guide
Data sovereignty in Australia: a practical guide
Last updated
What Australian law requires about where data lives, the sector rules that go further, and how to choose AI vendors with confidence.
What is data sovereignty?
Data sovereignty means data is subject to the laws of the country where it is collected or stored. Data residency is where it physically sits. Data localisation is a rule that it must stay onshore. The three are often confused, and the difference matters when you choose an AI or cloud vendor.
Data stored overseas may be reachable under foreign law. For example, data held by a US provider may be accessible under the US CLOUD Act, even when the customer is Australian. This is why many organisations keep sensitive information in Australian data centres.
Sovereign AI, private AI and onshore hosting
Onshore hosting means data is stored in an Australian data centre. Private AI means the models run on infrastructure you control, so prompts are not sent to a shared public service. Sovereign AI goes further: the service is operated in Australia, under Australian law, with local support and access.
Most organisations need private and onshore. Some government, defence and critical infrastructure workloads also need sovereign operation. The table below shows the four common deployment options.
AI deployment options compared
| Public AI service, enterprise terms | Private cloud, Australian or NZ region | Dedicated hosted infrastructure | On your own servers | |
|---|---|---|---|---|
| Where data sits | The provider's chosen regions, set by contract | A region you choose, in an account you control | A named data centre, on hardware reserved for you | Your premises or co-located racks |
| Who can access it | The provider's staff and systems, under its terms | Your staff, plus the cloud provider's operations | Your staff and the hosting operator | Only your staff and people you approve |
| Suitable workloads | Low-risk tasks on public or non-sensitive information | Most business documents and personal information | Sensitive data with strict residency terms | Highly sensitive or disconnected sites |
| Operational effort | Lowest | Moderate | Moderate to high | Highest |
What the Privacy Act requires
The Privacy Act 1988 applies to businesses with annual turnover above 3 million dollars, plus health service providers, government contractors and some others. It does not explicitly require data to be stored in Australia.
APP 8 is the cross-border rule. Before disclosing personal information overseas, you must take reasonable steps to ensure the recipient handles it in line with the APPs. If the overseas recipient breaches the APPs, your organisation can be held accountable as if it had breached them itself.
Other principles that matter for AI are APP 1 (open and transparent management), APP 6 (use and disclosure) and APP 11 (security). The Notifiable Data Breaches scheme requires you to notify the OAIC and affected people when a breach is likely to cause serious harm.
Sector rules that go further
Financial services
APRA CPS 234 requires information security controls over assets, including those managed by third parties, and CPS 230 covers material service providers.
Healthcare
The My Health Records Act 2012 requires My Health Record data to be held in Australia, on top of state health records laws.
Government contractors
Contracts often require Australian hosting, IRAP-assessed cloud services and cleared staff, under the PSPF and the ISM.
Critical infrastructure
The SOCI Act 2018 requires risk management programs and cyber incident reporting across 11 sectors.
How to check compliance
Map your data
Catalogue the personal information you collect and how it flows between systems.
Assess vendors
Confirm where each vendor stores and processes data, including backups.
Find the gaps
Rank compliance gaps by risk.
Move where needed
Shift sensitive workloads to hosting that meets your obligations.
Document
Update privacy policies, data processing agreements and procedures.
Monitor
Review annually and watch for regulatory change.
Vendor checklist
Australian data centres
Ask exactly where data is stored and processed, including backups and support access.
No training on your data
Confirm in the contract that prompts and outputs are never used to train models.
Data processing agreement
A vendor that refuses to sign one is a red flag.
Encryption
At rest and in transit, with clear key management.
Export and deletion
You can take your data out, or delete it, on request.
Security evidence
An ISO 27001 certificate, a SOC 2 report, or an IRAP assessment where government work requires it.
Questions
What is data sovereignty in Australia?
Data sovereignty means information is governed by the laws of the country where it is collected or stored. For Australian organisations that mainly means the Privacy Act 1988 and sector rules, plus any foreign law that can reach data held offshore or by a foreign-owned provider.
Can personal information be sent offshore for AI processing under APP 8?
Generally no, apart from specific cases such as My Health Record data. APP 8 instead requires reasonable steps before personal information is disclosed overseas, and your organisation can stay accountable for an overseas recipient's breach, which is why many choose Australian hosting anyway.
Which industries have the strictest data sovereignty requirements?
Government agencies and their contractors, healthcare, APRA-regulated financial services, critical infrastructure under the SOCI Act and defence suppliers. These sectors often require Australian data centres, IRAP-assessed services, cleared staff or documented third-party controls written into contracts.
Can we use US-based AI tools and still comply?
Yes, if the provider can meet the Australian Privacy Principles through a data processing agreement, encryption and clear handling terms, and you have weighed laws such as the US CLOUD Act that may allow foreign government access. Keep sensitive workloads on onshore, private deployments.
Who offers Australian data sovereignty for AI and GPU workloads?
Options include the Australian regions of the major cloud providers, Australian-owned sovereign cloud operators with IRAP assessments, and GPU servers on your own premises. Compare who operates the service and under which law, as well as where the hardware sits, and confirm backups and support access stay onshore.
Does the same apply in New Zealand?
New Zealand's Privacy Act 2020 has a similar cross-border rule, IPP 12, which limits disclosing personal information overseas unless the recipient has comparable safeguards or another exception applies. We can deploy AI on your infrastructure in New Zealand or Australia, in your cloud or on your own servers.
Check where your data goes
We can map your AI data flows against your obligations before anything is built.
Fixed-fee phases, agreed before we start. Stop after any phase.