Article

Data residency is not data sovereignty

Almost every major support platform will now sell you Australian data residency. Very few will tell you what it does not cover, so here is the distinction in the terms that actually decide it.

Two different questions

Residency asks: in which country do the bytes physically sit? It is a question about data centres, and it is answered by a region selector in a console.

Sovereignty asks: whose law can compel the company holding those bytes to produce them? It is a question about corporate structure, and no region selector touches it.

Vendors answer the first question loudly because they can. The second is answered by where the company is incorporated, and for most of the category that answer is the United States.

What the CLOUD Act actually does

The Clarifying Lawful Overseas Use of Data Act (2018) settled a question US courts had been arguing about for years: can a US provider be compelled to produce data it stores abroad? The Act's answer is yes. A provider subject to US jurisdiction must produce data in its possession, custody or control regardless of where that data is located.

So a US-headquartered support platform storing your tickets in Sydney is still a US company holding your data. The Sydney region changes the latency and the residency compliance story. It does not change who can be served an order.

Two details make this sharper than it first sounds. Orders can carry non-disclosure obligations, so the customer may never learn a request was made. And "possession, custody or control" is broader than ownership — a US parent with control over an Australian subsidiary's systems can be within scope.

Why APP 8 makes this yours, not theirs

Australian Privacy Principle 8 governs cross-border disclosure. The part businesses underestimate: when you disclose personal information to an overseas recipient, you generally remain accountable for what that recipient does with it. An act by them that would breach the APPs is treated as a breach by you.

That reframes the vendor question. You are not asking "is my vendor compliant". You are asking "have I made a cross-border disclosure, and am I comfortable carrying the accountability for it".

Choosing an Australian-owned processor does not manage that risk. It removes the disclosure from the picture, because there is no overseas recipient.

Support data is a bad place to be relaxed about this

Support desks accumulate an unusually rich picture of your customers, mostly as a side effect rather than by design. Not a tidy CRM record — the actual words people used. Screenshots with account details visible. Attached documents. A customer explaining a medical situation to get a refund approved. Someone pasting a password into a chat because they misread the question.

It is among the most sensitive data an organisation holds and among the least deliberately governed, because nobody designed it. It arrived.

Questions worth asking any vendor

  1. Where is your company incorporated, and which jurisdictions can compel you? Not where the data is — where you are.
  2. Do you publish a transparency report of government data requests? And does it break out Australian customers?
  3. Where does the AI inference run? Data at rest in Sydney means little if every ticket is sent to a US model for classification. Ask specifically, because this is the gap most residency claims leave open.
  4. What happens if a region fails — does processing fail over to another country? A failover that silently moves processing offshore undoes the guarantee precisely when you are not watching.
  5. Can I get everything back, and is that export tested? An export that reports success and omits a collection is not discovered until you need the missing part.

Our answers

Australian company, Fintech Development Pty Ltd, Darwin. Data in Sydney. Personal information and customer documents are processed by an onshore model that fails closed — if the Sydney inference endpoint is unavailable the request fails rather than falling back to a US region, because a silent failover is exactly the hole this whole argument is about. General classification runs on a disclosed US model under a data processing agreement, and we say which is which rather than implying everything is onshore.

The full position, including what you can hold us to →

Read next

Common questions

What is the difference between data residency and data sovereignty?

Residency is where data physically sits; sovereignty is whose law can compel its production. A US company storing data in an Australian region gives you residency but not sovereignty, because the US CLOUD Act reaches the company regardless of where the data is located.

Does the US CLOUD Act apply to data stored in Australia?

Yes, if the provider is subject to US jurisdiction. The Act requires a provider to produce data in its possession, custody or control regardless of where that data is stored, so Australian hosting by a US company does not put the data out of reach.

What does APP 8 require of me when I use an overseas provider?

Australian Privacy Principle 8 covers cross-border disclosure of personal information. In general you remain accountable for the overseas recipient's handling of it — an act by them that would breach the APPs is treated as a breach by you. Using an Australian-owned processor removes the cross-border disclosure rather than managing it.