Prices, bill drivers and 2026 rules
Australian data residency for cloud hosting: Sydney and Melbourne regions, APP 8, s 16C, IRAP and the Hosting Certification Framework
What hosting data in an Australian region does and does not settle under the Privacy Act, how APP 8 and s 16C treat overseas cloud storage, APP 11 security, and where IRAP and the HCF fit.
There is no general law requiring a private Australian business to keep its data in Australia, but where the data is held and who can access it from where changes your obligations and your risk. If the Privacy Act covers your business, APP 8 requires reasonable steps before personal information is disclosed to an overseas recipient, and section 16C generally makes you accountable for what that recipient does with it. The OAIC's guidelines say that giving data to an overseas cloud provider purely to store it, under a contract that keeps it in your effective control, may be a use rather than a disclosure, but you then still hold the information and must secure it under APP 11. Choosing a Sydney or Melbourne region simplifies this, but it does not, on its own, stop overseas access by support staff, replication, or global services. Government frameworks such as IRAP and the Hosting Certification Framework mainly matter if you hold government data.
This guide belongs to the pricing overview. It links to how to choose a host and support plans and licences. This is general information, not legal advice.
Does the Privacy Act cover your business?
The Australian Privacy Principles apply to Australian Government agencies and to organisations with an annual turnover above $3 million. Many smaller businesses are also covered, including health service providers, businesses that trade in personal information, contracted service providers to the Commonwealth, and businesses that have opted in. If you are not covered, your customers' contracts, industry codes or insurers may still ask for equivalent protections. Check the OAIC's small business guidance.
APP 8 and section 16C, in practical terms
- APP 8.1: before you disclose personal information to an overseas recipient, take reasonable steps to ensure the recipient does not breach the APPs. In practice this usually means an enforceable contract requiring APP-consistent handling, with the depth of steps matched to the sensitivity of the data.
- Section 16C: if the overseas recipient does something that would breach the APPs, it is generally treated as if your business did it. That accountability can apply even if you took reasonable steps.
- Exceptions (APP 8.2) include where you reasonably believe the recipient is bound by a law or binding scheme substantially similar to the APPs that the individual can enforce, and where the individual consents after being expressly told that APP 8.1 will not apply. These need care and documentation.
Cloud storage as "use". The OAIC's APP guidelines explain that providing personal information to an overseas cloud provider solely for storage and so that you can access it may be a use rather than a disclosure, where the contract binds the provider (and its subcontractors) to those purposes and you keep effective control: you can access, change and retrieve the data, you know who else can access it and what security applies, and you can have it deleted at the end. Even then you still hold the information, so a failure by the provider can be your breach of APP 11.
Region choice: what it settles and what it does not
| Question | Australian region chosen | Overseas region chosen |
|---|---|---|
| Where is the primary data stored? | Australia, if the service is regional | Overseas |
| Can support staff overseas access it? | Possibly; check the provider's access and support terms | Yes |
| Are backups or replicas kept elsewhere? | Only if you configure cross-region copies or the service does so by design | Depends on configuration |
| Do global services (DNS, CDN, email filtering, logging, AI features) process data overseas? | Often yes; check each service | Yes |
| Latency for Australian users | Usually lower | Usually higher |
| Price | Region-specific; often higher than the cheapest overseas regions | Region-specific |
The large public clouds operate regions in Sydney and Melbourne, and some providers also offer Canberra regions or zones positioned for government workloads; check each provider's current region list. Local and regional hosting providers run data centres in most capital cities. Using two Australian regions (for example Sydney for production and Melbourne for backups) keeps disaster-recovery copies onshore, at the cost of inter-region data transfer.
APP 11 security and the Notifiable Data Breaches scheme
APP 11 requires reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure, and to destroy or de-identify it when no longer needed. Since 11 December 2024, APP 11.3 makes clear that reasonable steps include technical and organisational measures. On cloud servers, that means multi-factor authentication on consoles, least-privilege access, patching, encryption, logging and tested backups. If a breach is likely to cause serious harm, the Notifiable Data Breaches scheme requires notification, and a suspected breach must be assessed within 30 days. Ask any host how it would tell you about an incident affecting your data and how fast.
IRAP and the Hosting Certification Framework: when they matter
- IRAP (Infosec Registered Assessors Program) is an Australian Signals Directorate program under which endorsed assessors assess systems, including cloud services, against ASD's Information Security Manual (ISM); check cyber.gov.au for the current program details. Government agencies use IRAP reports when choosing services. For a private small business, an IRAP assessment is a useful signal about a provider's controls, but read the scope: it covers particular services and classification levels, not everything the provider sells.
- The Hosting Certification Framework (HCF), run by the Digital Transformation Agency with the Department of Home Affairs, certifies hosting and cloud providers as Certified Strategic or Certified Assured for holding Australian Government data, with attention to ownership, control and supply-chain risk. Under the Australian Government's hosting policy, agencies it covers are expected to use certified providers for new hosting arrangements; the DTA and hostingcertification.gov.au publish the current policy, levels and list of certified providers. If you supply software or services to government and host its data, ask your agency contract manager which certification applies. Otherwise, HCF status is background information, not a requirement for an SME.
Frequently asked questions
Is using an overseas region illegal for a small business?
No general law prohibits it. Privacy Act obligations, contracts and industry rules may impose conditions. Check APP 8 if you are covered, and your customer contracts.
Does an Australian region guarantee data never leaves Australia?
Not by itself. Check support access, replication, global services and subcontractors.
What do I need from the provider to rely on the "use" approach?
A binding contract limiting the provider to storing and providing access, subcontractors bound the same way, and practical control over access, security and deletion. Get legal advice if the data is sensitive.
Do I need an IRAP-assessed provider?
Usually only if you hold government data or a customer requires it. Otherwise it is one input among many.
Sources
- Office of the Australian Information Commissioner — APP guidelines chapter 8 (cross-border disclosure) and chapter 11 (security); small business coverage; Notifiable Data Breaches
- Federal Register of Legislation — Privacy Act 1988, Schedule 1 and section 16C
- Australian Cyber Security Centre (ASD) — IRAP and the Information Security Manual
- Hosting Certification Framework — certification levels and certified providers
- Digital Transformation Agency — Australian Government hosting and cloud policy
