Data Sovereignty for Accountants: Where Data Goes

Data sovereignty concerns the laws and authority governing your practice’s information. Data residency is where that information is stored, including copies kept by cloud providers.

A server in Australia answers only part of a client’s question. You also need to know who can access their records and what happens when another service processes them.

What Data Sovereignty Means

Data sovereignty asks which jurisdictions can exercise authority over information and the organisations handling it. Data residency identifies the physical storage location. An Australian storage location can coexist with exposure to foreign law.

The Australian Government’s data storage and access factsheet explains that some foreign laws can apply across a company’s infrastructure. The location of a particular server does not necessarily limit those laws.

For a hypothetical practice, the document store could be in Sydney while an overseas support team can access it. The storage location is Australian. The access arrangements require a separate assessment.

• Incorrect claim: Australian storage means only Australian law can affect the information.
• Correct claim: Australian storage establishes a location. Assess the provider’s legal obligations and access arrangements separately.

Data residency compliance means meeting the location requirements that actually apply to the records and service. Identify the relevant law or contract before treating onshore storage as a requirement.

Australian Rules on Overseas Storage

Australian privacy law generally permits overseas cloud storage, subject to the obligations that apply to the practice. It does not impose a general requirement that every accounting practice keep all client records in Australia.

The Office of the Australian Information Commissioner (OAIC) explains that the Privacy Act generally permits overseas cloud services. A particular client contract or another applicable obligation can impose a narrower requirement.

For a practice covered by the Australian Privacy Principles, APP 8 generally requires reasonable steps before overseas disclosure. Those steps address how the overseas recipient handles the information. Exceptions apply.

The OAIC distinguishes disclosure from limited arrangements where information remains under your practice’s effective control. The contract and actual access determine the assessment. An overseas storage address alone does not answer it.

Our guide to the Australian Privacy Principles explains the wider privacy duties. Keep that assessment separate from whether a provider has an Australian data centre.

The Tax Practitioners Board’s cloud computing guidance covers offshore storage and the Code of Professional Conduct. Code Item 6 requires client permission before third-party disclosure unless a legal duty applies.

The TPB recommends explaining to whom and where information will be disclosed, including where it will be stored. Record the required permission before disclosure. A vendor’s storage promise does not supply the client’s permission.

Data Sovereignty and the Cloud

Cloud storage locations depend on the specific product and account settings. A provider’s Australian office or an Australian website address does not establish where your client’s records are stored.

MYOB’s Practice Compliance storage guidance says desktop data stays at the practice or its existing hosted location. Data created and copied to the cloud is stored in Sydney-region data centres. This describes Practice Compliance specifically.

Microsoft’s data location guidance explains that Microsoft 365 Copilot interaction content is stored at rest according to the account’s data residency configuration. Australian accounts are covered by its stated Product Terms residency commitments.

That is a commitment about the specified stored information. Ask separately about processing locations and any connected services. An AI assistant can send information through a different service from the document store it reads.

Use the provider’s product-specific documentation alongside your account’s location settings. Microsoft 365 administrators can inspect the Data Location Card. Retain written answers for details the settings do not show.

For every service holding client information, record the following details:

• The countries holding primary records and backups.
• Where AI processing occurs and what information goes to it.
• Who can access information for support, including their countries.
• Which subcontractors receive information and for what purpose.
• The contract terms for location changes, return and deletion.

Trace connected services as well as the main subscription. A document exported to an AI tool has its own handling arrangements, even if the original stays in Australia.

Sovereign AI in Australia

Sovereign AI offerings aim to give customers more authority over where AI runs and who operates it. Examine the promised arrangements, because Australian hosting and Australian operational control answer different questions.

An Australian-hosted service can run the model locally while a provider manages the hardware. A self-hosted model can run on equipment your practice manages. Either arrangement needs clear terms for support access and information leaving the environment.

CSIRO’s on-site AI infrastructure example shows AI processing close to the equipment generating the data. It demonstrates a local computing approach, rather than establishing a storage promise for an accounting product.

For your practice, a local AI service can reduce overseas processing where its contract covers the whole task. Establish whether prompts, outputs and diagnostic logs stay within that boundary. Check whether optional web searches send information elsewhere.

Sovereign AI does not establish the accuracy of a tax answer. Assess the model’s suitability for the work separately. Our private AI guide covers options for limiting access to practice information.

Answering Client Questions

Tell clients the confirmed storage countries and why your practice uses the services involved. Describe overseas processing or access separately. Avoid promising that every record stays in Australia when only one service has that commitment.

For a hypothetical practice with Australian document storage and a separate US processing service, the explanation could read:

We use cloud services to store your records and carry out your accounting work. Our document store holds files in Australia. A separate service processes selected information in the United States.

We will explain which information we propose to disclose and the service receiving it before seeking your permission. You can ask us about those arrangements before we send it.

Use that wording only where it matches your documented arrangement. Replace the countries and service description with the facts for your practice. Explain any overseas support access as well.

If a client asks for Australian-only handling, establish whether the request covers storage, processing and support access. Compare it with every service involved before agreeing. Record the agreed restriction so staff know which services they can use for that client.