South Australian Government agencies, councils and many SMEs that handle personal information increasingly ask suppliers a simple question: where will our data live? Australian data residency — keeping data in Australia-based cloud regions — has become a standard expectation in ICT tenders. This guide explains why buyers ask, what AWS and Azure offer in Australia, how residency relates to the Privacy Act, when residency alone is not enough, and the questions both buyers and suppliers should put in writing.
Why agencies ask for Australian regions
Public sector buyers are accountable for citizen and staff information, continuity of service and supply-chain risk. Specifying Australian hosting helps them:
- Align with organisational risk appetite and information security policies (including SA guidance such as the Information Security Management Framework where it applies)
- Reduce uncertainty about foreign legal access and cross-border disclosure
- Answer evaluators and auditors with a clear, evidenced hosting story
- Meet contractual and procurement clauses that name “Australian data residency” or “data must remain in Australia”
Residency is not the same as security or privacy compliance. It is one control among many. Buyers who treat it as a checkbox without asking about encryption, access, backups and subprocessors still carry residual risk.
AWS and Azure Australian regions (practical overview)
The two hyperscalers most often named in SA ICT work both operate regions in Australia. Exact region names and availability change over time — always confirm in the current provider documentation and your architecture design — but buyers and suppliers commonly discuss:
| Provider | Typical AU options buyers name | What to clarify in a tender |
|---|---|---|
| Amazon Web Services (AWS) | Asia Pacific (Sydney) and Asia Pacific (Melbourne) regions | Which services run in-region; where logs, backups and disaster-recovery copies go; whether any global control-plane or support tooling leaves Australia |
| Microsoft Azure | Australia East, Australia Southeast and other Australia geography options (including government-oriented offerings where relevant) | Region pair for resilience; Microsoft 365 / Entra / Purview data locations if those products are in scope; any multi-geo or global features |
For LLM and AI workloads, also confirm whether model inference, embeddings and vector indexes stay in the chosen Australian region. Enterprise offerings such as Amazon Bedrock and Azure OpenAI can support Australian residency for many use cases, but configuration and model availability vary — treat “we use Bedrock/Azure OpenAI” as incomplete without a region and data-flow statement. See our DevOps and cloud and LLM applications services for how we design this in practice.
Privacy Act and the APPs at a high level
The Commonwealth Privacy Act 1988 and the Australian Privacy Principles (APPs) apply to many Australian organisations, including most Commonwealth agencies and organisations above the turnover threshold, with additional obligations for health and other sensitive information. Key points for ICT projects:
- APP 8 (cross-border disclosure) sets expectations when personal information is disclosed to an overseas recipient. Keeping processing and storage in Australia can reduce (but does not automatically eliminate) cross-border disclosure issues.
- APP 11 (security) requires reasonable steps to protect personal information. Residency supports this story; it does not replace access control, encryption, logging or incident response.
- Notice and purpose still matter. Citizens and staff should understand what is collected and why, regardless of which Australian city hosts the servers.
This article is practical guidance, not legal advice. Agencies should involve their privacy officer or legal team for formal assessments. For AI-specific governance, see our note on responsible AI adoption.
When residency is enough — and when it is not
Residency helps when the main requirement is that primary data stores, backups and processing stay in Australian regions, and the solution can be designed that way without overseas subprocessors holding personal information.
Residency alone is not enough when any of the following are true:
- Support staff, managed service providers or SaaS tools outside Australia can access production data or admin consoles
- Telemetry, crash dumps, email gateways or CDN origins send personal information offshore by default
- AI features send prompts or documents to a model endpoint outside Australia
- Encryption keys, identity providers or secrets managers are configured in a non-Australian region
- Disaster recovery or “follow the sun” operations replicate data overseas without a documented exception
A useful mental model: residency is about where bits sit; sovereignty and privacy are about who can access them and under what rules. Buyers should ask for both a region map and an access map.
Questions for tenders (buyers and suppliers)
Use or adapt these questions in RFTs, RFQs and capability clarifications:
- Which cloud provider regions will host production data, backups and disaster-recovery copies?
- Will any personal information, prompts or documents leave Australia for inference, support, logging or analytics? If yes, list each flow and the legal basis.
- Which subprocessors (including AI model providers) touch the data, and where are they located?
- Who in the supplier organisation can access production systems, from where, and with what multi-factor authentication and logging?
- How are encryption keys managed, and do key-management services stay in Australian regions?
- How does the design align to Essential Eight-style controls for privileged access, backups and MFA? (See our Essential Eight guide for SA SMEs.)
- Can the supplier evidence the design with a simple data-flow diagram and a region statement suitable for evaluation?
Suppliers should answer honestly. “Australian residency for primary storage, with named exceptions for X and Y” scores better than an absolute claim that does not survive clarification.
Practical next steps
- Buyers: put residency and cross-border disclosure questions in the statement of requirements, not only in a generic security schedule.
- Suppliers: prepare a one-page hosting and data-flow statement before the tender drops, alongside your capability statement materials.
- Both: treat AI workloads as first-class data flows — prompts and retrieved documents are often personal information too.
- Both: budget for Australian-region pricing honestly rather than trimming residency to save money; our guide to cloud cost control for SA councils and small businesses shows where safe savings usually are.
If you are scoping a cloud or LLM project for an SA agency or council, discuss your project with our team or review how we approach secure cloud delivery and LLM applications with Australian residency.