Australian data sovereignty: what the rules require and where your data can live

Part of: Data centre and hostingServer rooms, colocation, hybrid cloud and data sovereignty, planned by people who will still run it.

Australia has no single data sovereignty law. For most private organisations, Australian Privacy Principle 8 and section 16C of the Privacy Act 1988 apply when personal information goes overseas: you must take reasonable steps to ensure the recipient complies, and you stay accountable if it does not. Sector rules, such as CPS 234 and the SOCI Act, add requirements.

If you are asking where your organisation's data is allowed to sit, the honest answer is that it depends on what the data is, who you are and who you serve. This guide is a plain-English map for IT, operations and finance leads. It sits alongside our data centre and hosting page, which covers how we approach hosting more broadly.

This is general information, not legal advice. Ask your lawyer or compliance adviser to confirm how the rules apply to you. Guidance changes, so check the current edition of each source listed at the end. By the time you finish, you will know the key terms, the Privacy Act test, the main sector rules and the questions to put to any provider.

Key Takeaways

• Data sovereignty, data residency and data localisation are different ideas. Location alone does not settle who can compel access to your data.
• Most private organisations face no general rule that data must stay in Australia. They face an accountability rule: APP 8 and section 16C.
• The OAIC says an overseas cloud arrangement can be a use rather than a disclosure, but only when the contract and your control over the data support that conclusion.
• Sector rules add more: the DTA Hosting Certification Framework for Australian Government data, APRA CPS 234 for regulated entities, the SOCI Act for critical infrastructure, and specific health data rules.
• Ask providers where data and backups sit, where support staff sit, which jurisdictions can compel access and what each certification actually covers. Get the answers in the contract.

Summary Table

What is the difference between data sovereignty, data residency and data localisation?

Data residency is the physical location where data is stored. Data localisation is a legal requirement that data stay in a particular place. Data sovereignty is broader: data is subject to the laws of the country where it sits, and to the laws of any country that can compel the provider to hand it over.

The distinction matters because location and control are not the same thing. A provider can store your data in an Australian region and still be owned by a company headquartered overseas. That parent may be subject to foreign legal powers. The US CLOUD Act (Clarifying Lawful Overseas Use of Data Act 2018) is the example most often raised: it can allow US authorities to require US-based providers to disclose data in their possession, custody or control, wherever it is stored. Australian agencies have their own powers too, so sovereignty cuts both ways.

Australia's approach for the private sector is not a blanket localisation law. It is an accountability model built on the Privacy Act, with sector rules layered on top. That is why two organisations in the same suburb can have very different obligations. A manufacturer with customer contact details has one set of questions. A superannuation fund or a water utility has another.

What do Australian Privacy Principle 8 and section 16C require?

APP 8 requires an organisation to take reasonable steps, before disclosing personal information to an overseas recipient, to ensure the recipient does not breach the Australian Privacy Principles. Section 16C then makes the Australian organisation accountable for the overseas recipient's acts that would breach the APPs, unless an exception applies.

These obligations apply to APP entities. That includes Australian Government agencies and many private organisations. According to the OAIC, the small business exemption generally covers businesses with annual turnover of $3 million or less, but there are exceptions, such as health service providers. A mid-sized organisation should assume it is covered.

APP 8.2 lists exceptions. The main ones are:

• You reasonably believe the recipient is subject to a law or binding scheme that protects information in a substantially similar way to the APPs, and the individual can access mechanisms to enforce it.
• The individual consents after being told that APP 8.1 will no longer apply and you will not be accountable under section 16C.
• The disclosure is required or authorised by or under an Australian law or court order.

Two cautions. First, consent is harder to rely on than it sounds. The OAIC expects it to be informed, voluntary, current and specific, which is difficult to achieve with staff or customers at scale. Second, the Privacy and Other Legislation Amendment Act 2024 added a mechanism for regulations to prescribe countries and binding schemes for the substantially similar test. Check the current regulations before relying on it.

In practice, "reasonable steps" usually means a written contract that requires the overseas provider to handle personal information in line with the APPs, plus due diligence on how it actually operates.

One scope point is easy to miss. APP 8 covers personal information. Commercial data, intellectual property and financial models that do not identify individuals are outside it, although contracts, customer agreements and sector rules may still restrict where they go.

When is an overseas cloud arrangement a use rather than a disclosure?

The OAIC's APP guidelines indicate that passing personal information to an overseas cloud provider can be a use, not a disclosure, when the provider only stores and provides access to it for limited purposes and your contract keeps effective control with you. If it is a use, APP 8 and section 16C do not apply.

The distinction turns on facts, not labels. The OAIC guidance points to features that support a use characterisation:

• The contract limits the provider to storing the information and letting you access it.
• The provider cannot use or disclose the information for its own purposes.
• You keep effective control, including the right to retrieve, delete and decide what happens to the information.

If the provider can look into content for its own analytics, advertising or product development, the arrangement looks more like a disclosure. Read the data processing terms closely.

Here is where I would be careful. A use characterisation is not a loophole. Even when an arrangement is a use, you remain responsible for securing the information under APP 11, and you remain accountable for what happens to it. My view is to run the same due diligence either way. Customer-held encryption keys also strengthen the case that you retain control, though whether they are enough is a question for your adviser.

The OAIC's guidance sits in Chapter 8 (APP 8) and Chapter B (key concepts) of the APP guidelines. Both are linked in the references.

Which sector rules add data location and control requirements?

Beyond the Privacy Act, requirements depend on your sector. Australian Government data falls under the DTA's Hosting Certification Framework. Regulated financial entities face APRA CPS 234 and CPS 230. Critical infrastructure owners face the SOCI Act. Some health data has its own location rule. Most mid-sized organisations touch at least one.

Australian Government data and the Hosting Certification Framework

The Hosting Certification Framework is a policy of the DTA, the Australian Government agency responsible for digital and hosting policy. It guides how Australian Government entities choose hosting providers. It has two certification levels: Certified Strategic and Certified Assured.

As I read the framework, Certified Strategic carries the strongest weight on Australian ownership and control, while Certified Assured focuses on assured security with transparency about ownership and location. Which level suits which data depends on the data's classification and the framework's current text, so read the DTA's current edition rather than rely on a summary, including mine.

The framework does not bind private organisations directly. It still matters if you supply to government, because contracts can pass requirements down. It is also a useful benchmark for any organisation.

Do not confuse certification with IRAP. IRAP, the Information Security Registered Assessors Program run by the Australian Signals Directorate, is an assessment of a cloud service against the Information Security Manual. Certification is a statement about a provider and a defined scope. Ask any provider, us included, to show you the certificate and what it covers.

APRA-regulated entities: CPS 234 and CPS 230

CPS 234 Information Security took effect on 1 July 2019. It applies to APRA-regulated entities and requires information security capability proportionate to the threats to your information assets. That includes assets managed by related parties or third parties. Per the standard, you must evaluate the design and operating effectiveness of a third party's controls, and notify APRA of material information security incidents within 72 hours.

CPS 234 does not ban offshore hosting. It makes the board accountable and expects you to know exactly what controls protect your data, wherever it is held. CPS 230 Operational Risk Management, effective 1 July 2025, adds expectations on material service providers and includes notification requirements for certain offshore arrangements. Read APRA's current text for the detail.

Critical infrastructure and the SOCI Act

The Security of Critical Infrastructure Act 2018, as amended, is administered by the Cyber and Infrastructure Security Centre within the Department of Home Affairs. It covers a defined list of critical infrastructure sectors, and data storage or processing is one of them. Depending on the asset, responsible entities may need to register it, report cyber incidents and maintain a risk management programme.

A mid-sized organisation in energy, water, health, transport, communications or food and grocery may be in scope without having thought of itself as critical infrastructure. Check the CISC guidance to confirm whether your asset is covered.

Health data and state government frameworks

The My Health Records Act 2012 (section 77) restricts holding, taking, handling or processing My Health Record information outside Australia. It is one of the few genuine localisation rules in Australian law.

State and territory governments set their own policies, for example the Victorian Protective Data Security Framework and the NSW Cyber Security Policy. I have not summarised their location requirements here because they change and vary by agency. If you supply to a state agency, ask for the current policy and the data location clauses in your contract.

What should you ask a hosting or cloud provider about data sovereignty?

Ask where primary data and backups are stored, where support staff sit and can access it from, which countries' laws can compel the provider to hand it over, and what each certification actually covers. Then ask for those answers in the contract, not just the sales deck or a webpage.

1. Where is the data stored, including backups? Primary storage is the easy answer. Press on replicas, disaster recovery sites, archives, logs and monitoring data. Ask whether backups can leave the country and whether you choose the region or the provider does.

2. Where do support staff sit, and can they see content? Remote access from offshore is still access. Ask whether support is delivered from overseas, whether administrators can view your content or only metadata, and whether that access is logged and approved. Knowing who answers the call is part of sovereignty. We believe in real people, not a ticket queue, and a provider should be able to tell you where those people are.

3. Which jurisdictions can compel access? Ask where the provider and its parent company are headquartered and which legal orders they could receive. Ask whether they will notify you of a request where the law allows, and whether you can hold the encryption keys.

4. What does each certification cover? Certifications describe a scope, not a provider's whole business. Ask which services, regions and dates the certificate covers. Ask for the IRAP report scope, the Hosting Certification level or the ISO/IEC 27001 scope statement, as relevant, and who assessed it.

5. Who are the subcontractors, and what happens when you leave? Ask which third parties touch your data, how deletion is verified and how you get your data back in a usable form.

If you run Microsoft 365 or Azure, check Microsoft's current documentation on data location for your tenant and chosen regions. Our Microsoft cloud page covers how we approach migrations. In our own method, "How a move works", sovereignty belongs in the first step, Assess, before anything is migrated.

Sovereignty is an evidence problem, not a map problem

Most sovereignty conversations start with a map. Is it in Sydney or Melbourne? That is the wrong first question. Location is one control among several. The better question is whether you can show a board, a regulator or an auditor who can access what, from where, under whose law, and what happens at exit.

That view comes from building and supporting a data centre and continuity environment for a government team. The outcome that mattered most was that its auditors could sign off the result. They were not persuaded by assurances. They wanted documented evidence. The lesson I took away is that sovereignty is a paper trail as much as a postcode: contracts, scope statements, access logs and tested recovery.

The second point is the one people forget. Data sovereignty includes the end of the data's life. Devices are the easy part. The lifecycle is the work. When client devices reach end of life, we retire them through PonyUp for Good, with data destroyed before devices are refurbished and resold. A sovereignty policy that stops at the cloud contract but ignores the old laptops in a cupboard has a hole in it.

Finally, a position some will find unfashionable. We work with organisations that want to be safe, not scared. For many organisations with no sector obligation, my view is that a clearly contracted Australian region, customer-held keys, a documented support model and a tested exit plan is a sensible, defensible position. That is a view, not legal advice. Confirm it with your adviser. If something is fine, we will tell you it is fine.

A sensible next step

Start with an inventory: what personal information you hold, which providers touch it, where it sits and which sector rules apply. Then test each provider against the five questions above. Our sovereignty section on the data centre page sets out how we think about location and control, and our guide to data centre services in Australia covers the wider hosting decisions.

If you would like a second pair of eyes on your current arrangements, we do it the human way: a conversation with someone who owns the outcome, not just the ticket. Book a capability call and we will talk through where your data lives and what to check first.

References

• OAIC, Australian Privacy Principles guidelines, Chapter 8: APP 8 Cross-border disclosure of personal information
• OAIC, Australian Privacy Principles guidelines, Chapter B: Key concepts
• DTA, Hosting Certification Framework and Hosting Strategy
• APRA, Prudential Standard CPS 234 Information Security
• Cyber and Infrastructure Security Centre, Security of Critical Infrastructure Act 2018 guidance
• Australian Signals Directorate, Information Security Registered Assessors Program (IRAP)

Frequently asked questions

Is there a law that says Australian data must stay in Australia?

Not generally. There is no blanket localisation law for the private sector. Some specific rules restrict location, such as section 77 of the My Health Records Act 2012, and government hosting policies and contracts can require onshore storage. Otherwise, the Privacy Act's APP 8 and section 16C govern personal information sent overseas.

Does using an overseas cloud provider breach the Privacy Act?

Not by itself. If you disclose personal information overseas, APP 8 requires reasonable steps to ensure the recipient complies with the APPs, and section 16C keeps you accountable. If the arrangement is a use, because the provider only stores the data and you retain control, APP 8 does not apply, but security obligations still do.

What is the difference between IRAP assessment and Hosting Certification?

IRAP is an assessment of a cloud service against the Information Security Manual, carried out by an assessor in the Australian Signals Directorate's program. Hosting Certification is a DTA framework for Australian Government hosting, with Certified Strategic and Certified Assured levels. They are different things. Ask any provider for the certificate or report and its scope.

Does storing data in an Australian region make it sovereign?

No. An Australian region addresses residency. Sovereignty also depends on who owns and operates the provider, where support staff access data from, and which countries' laws could compel disclosure. Ask about ownership, support access, backups and encryption key control, and get the answers in writing.

Does CPS 234 require APRA-regulated entities to keep data onshore?

CPS 234 does not set a location rule. It requires information security capability that matches the threats to your information assets, including those managed by third parties, and notification to APRA of material incidents. CPS 230 adds service provider expectations, including notification for certain offshore arrangements. Check APRA's current text and take advice.

Keep reading

data centre services Australia

Data Centre Services in Australia: A Practical Guide

13 min read

cyber incident cost for schools

What a Cyber Incident Costs a School, Measured in a Term

19 min read

how to choose a cyber security consultant

How to choose a cyber security consultant, and what to ask them

16 min read