Where Does Your Business Data Actually Go When You Use AI Tools?
It took a large enterprise customer more than a year to get a straight answer from Microsoft.
Their Microsoft Dynamics 365 setup included Copilot. The help page said clearly: “Australian customers: your data will remain on shore.” That should have been enough. It wasn’t. When the customer’s team pushed for specifics (exactly which Azure region, exactly what guarantees), Microsoft couldn’t confirm it. The answer kept shifting. After twelve months of escalation, Microsoft modified the solution and updated the documentation to match what was actually happening.
One year. A company with lawyers, procurement staff, and real bargaining power. Twelve months to get an honest answer about where their own data was going.
Now ask yourself: when did you last push an AI vendor on this?
Most Australian small business owners haven’t. Not because they don’t care about data security. But because the question never comes up. You sign up for a tool, click through the terms, and get to work. The data goes somewhere. You assume it’s fine.
It may not be.
You Are Accountable, Even When the Vendor Isn’t
Under Australian Privacy Principle 8 (APP 8), any business subject to the Privacy Act that discloses personal information to an overseas recipient remains legally responsible for how that recipient handles it. Not the vendor. You.
The OAIC’s official APP 8 guidance is direct: an APP entity “is accountable for any acts or practices of the overseas recipient in relation to the information that would breach the APPs.” Before you send personal information overseas, you’re required to take reasonable steps to ensure that the receiving party will handle it consistently with Australian standards.
The 2024 Privacy Act reforms tightened this further. According to Levo.ai’s April 2026 analysis, “accountability now follows personal data beyond national borders, regardless of how or why it is transferred.” The vendor’s terms of service, that document you didn’t read, doesn’t transfer your legal exposure to them.
This isn’t abstract. The OAIC’s January–June 2025 Notifiable Data Breach statistics specifically flag outsourcing personal information handling to third parties as a contemporary threat. A contractor uploading names, contact details, and health records into an unauthorised AI system was classified as a notifiable data breach, according to Think Technology Australia’s June 2026 governance report. Separately, a software developer accidentally leaked Australian government documents via an AI tool, also reported to the OAIC, per Information Age.
These aren’t edge cases. They’re what happens when people use AI tools without asking where the data goes.
Two Questions, and Most Vendors Only Answer One
There’s a distinction most vendors won’t draw for you, and it matters.
There are two separate questions about your data:
Where is my data stored?
Where is my data processed when AI has run?
Those are not the same question, and the answers are often different.
As Lorikeet CX noted in their June 2026 data residency guide: “The hard part in 2026 is that AI introduces a model layer (the LLM) that often sits offshore even when the application database does not.”
Accounting software like Xero or MYOB stores its core database in Australia, confirmed by Aivy’s June 2026 review of Australian accounting platforms. But when those platforms run AI features, Xero Analytics Plus or MYOB’s AI integrations, they may route your data through third-party LLM APIs. Those APIs often run on US servers. The database is local. The AI layer is not.
A vendor can tell you “your data is stored in Australia” and be telling the truth. What they’re not telling you is where the AI inference happens when you use their smart features.
What the Main Tools Actually Do
The five tools below cover most of what Australian SMBs are running day-to-day.
Microsoft 365 Copilot. Australia is included in Microsoft’s data residency commitments for Copilot Chat. The Microsoft Learn documentation (updated February 2026) lists Australian tenants explicitly, and the Advanced Data Residency (ADR) add-on provides stronger guarantees. But the default for standard plans may not guarantee in-country processing. As the enterprise story above shows, getting a confirmed answer takes real effort. SMBs on standard M365 plans should check explicitly, not assume.
Google Workspace AI (Gemini). Google has Australian data centres in Sydney and Melbourne. Whether your AI feature data stays in them depends on your plan tier. As XCD IT noted in their July 2026 guide, “Australian businesses should confirm data residency settings before enabling Gemini on any account handling client or customer information. Gemini data protections differ between Workspace tiers, and not all plans offer the same enterprise commitments.” Free and standard plans have fewer protections.
Xero / MYOB. Core data is stored in Australia. The AI layer is a separate question. Per Aivy’s June 2026 analysis, major accounting platforms maintain Australian data centres, but third-party tools used for AI processing may route data through overseas servers. If you use Xero’s AI-powered analytics or MYOB’s smart features, ask specifically where LLM inference happens.
ChatGPT / OpenAI. According to the OpenAI Help Center (updated June 2026), data residency for ChatGPT is available in the EU, UK, US, Canada, Japan, South Korea, Singapore, and India. Not Australia. If you’re using ChatGPT, free or business tier, your data is processed in the US by default. There is no AU residency option.
Notion AI. Data residency is available for Enterprise customers in the US or EU only. No Australian region exists. Free and Business plan users have no control over where their data sits, and Notion AI routes through US servers.
5 Questions to Ask Your AI Vendor
You don’t need a legal team. You need the right questions in an email. If a vendor can’t or won’t answer these, that’s your answer.
1. Where is my data stored at rest, and in which country? Many vendors say “Australia.” Get the specific region. That’s the easy part, and only half the picture.
2. Where is my data processed when AI has are active? The storage question and the processing question are different. This is where most vendors go quiet. Push for a specific answer on LLM inference location.
3. Which subprocessors handle my data, and where are they located? Most AI tools use third-party APIs, OpenAI, Anthropic, or Google. Ask for the full subprocessor list. It should be in their privacy policy or Data Processing Agreement. If it’s not there, ask directly.
4. How long do you retain my data, and can I request deletion? This matters especially for AI features. Some platforms use customer inputs to train or improve their models. Under current APP guidance and the 2024 reforms, your right to request deletion is protected. Get the retention period and deletion process in writing.
5. Will you notify me if there’s a breach involving my data? Under APP 11 and the Notifiable Data Breaches scheme, you need to know quickly. Ask for the vendor’s breach notification timeframe and confirm it meets Australian requirements.
Send these questions before you renew. Not after.
The Uncomfortable Truth
The enterprise customer in this story had real bargaining power. A year of sustained pressure and the credibility to keep escalating. They got their answer and got the configuration fixed.
You probably don’t have that bargaining power. But you have the right to ask. Under Australian privacy law, you have a legal obligation to.
The 2024 Privacy Act reforms didn’t create new exposure for Australian businesses. They clarified exposure that was already there. If your AI tools are processing customer data offshore without your informed awareness, that’s not a technology problem. It’s a compliance problem with your name on it.
Ask the questions. Get the answers in writing. And if a vendor tells you “Australian customers: your data will remain on shore,” push until you know exactly what that means.
📬 The SmallBizAI Brief
One practical AI tip for Australian small business. Every Tuesday. Free.
Join business owners getting smarter about AI every week.
Sources
- OAIC, Chapter 8: APP 8 Cross-border disclosure of personal information: https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-8-app-8-cross-border-disclosure-of-personal-information
- OAIC, Sending personal information overseas: https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/sending-personal-information-overseas
- OAIC, Notifiable Data Breach statistics Jan–Jun 2025: https://www.oaic.gov.au/news/blog/latest-notifiable-data-breach-statistics-for-january-to-june-2025
- Levo.ai, Australian Privacy Act 1988 (2026 Update): Overseas Data Rules: https://www.levo.ai/resources/blogs/australian-privacy-act-1988-cross-border-data-compliance
- Lorikeet CX, Australian Data Residency for AI Customer Support (2026): https://www.lorikeetcx.ai/articles/ai-support-australian-data-residency-guide
- LegalVision, Obligations: Sharing Personal Information Overseas: https://legalvision.com.au/privacy-obligations-when-sharing-personal-information-overseas/
- Microsoft Learn, Data Residency for Microsoft 365 Copilot: https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-service-copilot?view=o365-worldwide
- OpenAI Help Center, Data residency and inference residency for ChatGPT: https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt
- Notion Help Center, Data residency: https://www.notion.com/help/data-residency
- Aivy.com.au, Best AI Tools for Accountants in Australia (2026): https://aivy.com.au/resources/ai-tools-for-accountants-australia/
- XCD IT, Best AI Tools for Brisbane Businesses 2026: https://xcdit.com.au/best-ai-tools-for-brisbane-businesses/
- Think Technology Australia, AI Governance Framework for Australian SMBs: https://www.thinktechnology.com.au/blog/ai-governance-framework-smbs/
- Information Age / ACS, Software dev accidentally leaks Australian government documents: https://ia.acs.org.au/article/2025/software-dev-accidentally-leaks-australian-govt-documents.html
More in this series: News Deep Dives →
Related: Data sovereignty in Australian business, our guide to evaluating AI vendors and data compliance.
More practical guides: How-To Hub →
📊 Compare AI tools side by side | 💼 Free resources & AI prompt packs
