Choosing an Australian cloud region answers one question about where information is stored. It does not, by itself, answer who can access it, where support teams operate, which subcontractors are involved or whether the arrangement meets your obligations.
A cloud compliance review should connect the information you hold, the requirements that apply and the evidence the provider can supply. This guide is general information, not legal advice. Obtain advice on your particular obligations before making a compliance decision.
Establish which requirements apply to your business
Do not assume every Australian business has identical Privacy Act obligations. The OAIC’s small-business guidance explains that many businesses with annual turnover of $3 million or less are generally exempt, but important exceptions apply, including health service providers and some businesses trading in personal information.
Check the full circumstances rather than relying on turnover alone. State or territory laws, industry obligations, customer contracts and insurance conditions may also matter. A suitably qualified adviser can establish the legal requirements; the technical review then needs to show how the proposed arrangement supports them.
Review collection, access and retention as well as security
For entities covered by the Australian Privacy Principles, cloud use does not remove responsibility for personal information. The OAIC’s APP summary covers collection, notification, use and disclosure, overseas disclosure and security.
Consent is not a blanket prerequisite for every collection of personal information. Sensitive information generally has a higher collection standard, including consent unless an exception applies. Understand the relevant rule, what people need to be told and whether the proposed use is appropriate.
Map who can access the information, how access is approved and removed, and how records are retained or destroyed. Encryption is one safeguard alongside access and retention controls.
Look beyond the primary hosting location
Ask where backups, logs and replicated copies reside, and whether overseas support staff or subcontractors can access personal information. An Australian storage region does not necessarily mean all handling stays in Australia.
The OAIC’s APP 8 guidance explains overseas disclosure requirements and exceptions. In general, an APP entity must take reasonable steps before disclosing personal information overseas to ensure the recipient does not breach the APPs, subject to the applicable exceptions. Whether an arrangement is a use or a disclosure can depend on effective control and the facts.
Overseas processing is not automatically prohibited, but a particular agreement or regulatory requirement may impose stricter residency conditions. Document those conditions and confirm the provider can meet them, including during support and recovery.
Check overseas rules only where they apply
GDPR scope is not determined simply by whether a person is an EU citizen. The European Commission’s guidance addresses processing connected with an EU establishment and certain activities by organisations outside the EU, including offering goods or services to individuals in the EU or monitoring their behaviour there.
If your activities bring those rules into scope, obtain advice about the relevant roles, processing arrangements and transfers. Similarly, do not use a US healthcare compliance label as a substitute for assessing Australian health-information requirements. For payment data, establish the relevant payment-security responsibilities with your payment provider and adviser.
Ask the provider for evidence
- Data locations. Where are primary records, backups, logs and recovery copies held?
- Access. Who can administer the service, what MFA is available and what activity is logged?
- Subcontractors. Which organisations process information, and how are changes communicated?
- Ownership. Who controls the accounts, records and any customer-managed keys?
- Incidents. What notification, investigation and evidence-sharing arrangements are documented?
- Recovery. What can be restored, by whom and with what tested dependencies?
- Exit. How can you export information and arrange deletion, including retained copies?
Read the scope and currency of assurance reports and certifications rather than treating a badge as approval for every use. A feature being available does not show that it has been enabled correctly in your environment.
Keep a record of the decision
Record the service, information involved, applicable requirements, supporting evidence, accepted risks and owner. Revisit the assessment when the use changes. As a hypothetical example, adding identity documents to a booking system changes the information being handled even if the provider stays the same.
For the technical side of a cloud services review, talk to Milnsbridge.
