Bill shocks, exits and official sources
Official sources for cloud and hosting decisions in Australia: tax, privacy, security, contracts and help
Which Australian government bodies and official portals to check for GST, privacy and cross-border data, cyber security, government hosting rules, contracts, domains and small business disputes.
For a cloud or hosting decision, the official sources that matter most to an Australian small business are the ATO (GST on local and imported hosting, deductions and record keeping), the OAIC (Privacy Act coverage, APP 8 cross-border disclosure, APP 11 security and data breaches), ASD's Australian Cyber Security Centre at cyber.gov.au (securing cloud accounts, backups, IRAP and the ISM, and reporting cybercrime), the DTA and the Hosting Certification Framework (only if you handle government data), the ACCC (unfair contract terms, consumer guarantees and the 2027 subscription rules), the Federal Register of Legislation (the law itself), auDA (.au domains), and the ASBFEO and state small business commissioners for disputes. This page lists what to check on each and how to use them alongside provider price pages.
This guide belongs to the section overview, why cloud bills blow out. It links to outages and SLA credits, exit costs and lock-in and data residency and APP 8.
The sources at a glance
| Body or portal | What to check there | Relevant guides |
|---|---|---|
| Australian Taxation Office | GST on hosting, imported digital services and the reverse charge; ABN and GST settings; prepaid expenses; record keeping | GST on cloud hosting |
| Australian Business Register | Checking a supplier's ABN and GST registration | GST guide |
| Office of the Australian Information Commissioner | Whether the Privacy Act covers you; APP guidelines chapters 8 and 11; Notifiable Data Breaches | Data residency and APP 8 |
| ASD's Australian Cyber Security Centre | Small business cloud and account security, Essential Eight, ISM, IRAP, ReportCyber | Why bills blow out |
| Digital Transformation Agency and the Hosting Certification Framework | Government hosting policy; certified providers and levels | Data residency guide |
| Australian Competition and Consumer Commission | Unfair contract terms, consumer guarantees for services, subscription rules | Contract terms |
| Federal Register of Legislation | Current text of the Privacy Act, GST Act, Competition and Consumer Act and amending Acts | All rules guides |
| .au Domain Administration (auDA) | .au domain eligibility, licence terms, transfers | Renewal price shocks |
| ASBFEO and state small business commissioners | Dispute help with suppliers | Outages and SLA credits |
| Reserve Bank of Australia | Historical exchange rates for budgeting USD bills | USD pricing and FX |
| business.gov.au | Plain-language guidance on technology, contracts and cyber security for small business | Throughout |
How to use them well
Check the date. Official pages are updated as laws change. Look for "last updated" dates and, for the law itself, the compilation date on the Federal Register of Legislation.
Read guidance as guidance. OAIC guidelines and ATO guidance explain how the regulator applies the law. They are persuasive and important, but the Act is the law. For a significant decision, check both and get advice where the stakes are high.
Separate law from good practice. ASD's Essential Eight and cloud guidance are strongly recommended practice for businesses; for most private businesses they are not legal requirements in themselves, but they help show the "reasonable steps" APP 11 asks for, and insurers and customers may expect them. In October 2026 ASD began introducing a new framework, ASD Essentials, alongside the Essential Eight; check cyber.gov.au for how it applies.
Government data is different. The Hosting Certification Framework, IRAP assessments and the Protective Security Policy Framework apply to Australian Government agencies and flow to suppliers through contracts. If you do government work, your contract and the agency tell you what applies.
Provider pages are for prices; official pages are for rules. No official body publishes hosting prices. Use the provider's own price page for your region, dated, for each line of your estimate.
Questions and the source that answers them
| Question | Where to look first |
|---|---|
| Should an overseas cloud bill include GST? | ATO: GST on imported services and digital products |
| Are we covered by the Privacy Act? | OAIC: small business guidance |
| Can we store customer data in an overseas region? | OAIC: APP guidelines chapter 8 |
| What security is "reasonable" for our cloud server? | OAIC: chapter 11; ASD small business guidance |
| Our cloud account was compromised and a big bill appeared | ASD ReportCyber; the provider's support; IDCARE for support |
| Can our host change prices mid-contract? | ACCC: unfair contract terms; your contract |
| Do we need a certified provider for a government contract? | The agency and the Hosting Certification Framework |
| Our domain is held by a former contractor | auDA (for .au names) and your registrar |
| We have a dispute with our host | The provider in writing, then ASBFEO or the state small business commissioner |
When to get professional advice
- You hold health, financial or other sensitive information in the cloud.
- You are considering storing personal information overseas and relying on an APP 8 exception or the "use" approach.
- You are partly input-taxed or use cloud services partly privately (GST reverse charge).
- You face a significant loss from an outage or data loss and want to understand your rights.
- You are bidding for government work that involves hosting government data.
A lawyer, registered tax agent or independent IT security adviser who does not sell the service is the right starting point.
Frequently asked questions
Is there an official comparison of hosting providers?
No. Government bodies do not compare or rate commercial hosting providers, apart from the government-only certification lists. Be cautious of "official" rankings.
Is the Hosting Certification Framework list useful to a small business?
As background, yes: it shows which providers have passed government assessment for particular services. It is not a requirement for private businesses.
Where do I report a scam invoice for hosting or domains?
Report scams through Scamwatch, and report cybercrime through ReportCyber. Fake domain renewal notices are a long-running scam pattern; check with your registrar directly.
Who regulates hosting providers?
There is no single hosting regulator. Privacy, consumer, contract, tax and cyber security laws each apply through their own regulator.
Sources
- Australian Taxation Office — GST, deductions and record keeping
- Office of the Australian Information Commissioner — Privacy Act and APP guidelines
- Australian Cyber Security Centre (ASD) — cyber security guidance and ReportCyber
- Hosting Certification Framework — certified hosting providers for government data
- Digital Transformation Agency — government hosting and cloud policy
- Australian Competition and Consumer Commission — unfair contract terms and consumer guarantees
- Federal Register of Legislation — Acts and compilations
- .au Domain Administration — .au domain rules
- Australian Small Business and Family Enterprise Ombudsman — dispute help
- Scamwatch — reporting scams
- IDCARE — identity and cyber support
