Which AI Tools Keep Your Data in Australia? The Complete Guide for 2026

Australian businesses have been asking this question more often as the government’s review of the Privacy Act 1988 pushes data handling higher up the compliance agenda. For most small businesses, the question comes down to something practical: where do your documents, conversations, and customer records actually sit?

The answer varies by tool, and the gap between what companies claim and what their terms actually say is worth understanding before you start uploading client data.

What data residency actually means

Data residency means the physical location of the servers where your data is stored. This is distinct from where the company is incorporated (a US company can host data in Australia) and from where data is processed (some tools store data locally but ship it offshore for AI features).

For Australian businesses, the Privacy Act 1988 governs how personal information is collected, stored, and transferred offshore. If your business handles personal information about clients or employees, you’re responsible for ensuring that offshore transfers meet the requirements of the Act, including that the overseas recipient doesn’t breach the Australian Privacy Principles.

The Office of the Australian Information Commissioner (OAIC) provides guidance on cross-border disclosure at oaic.gov.au, Chapter 8: Cross-border disclosure of personal information.

Tools with Australian data centres

Microsoft 365 (microsoft.com/en-au/microsoft-365) has Australian data centres in New South Wales and Victoria. For most Microsoft 365 business plans, core data, Exchange email, SharePoint, Teams, and OneDrive, stores in Australia for Australian tenants. You can verify your data location in the Microsoft 365 admin centre under Settings > Org settings > Organisation profile > Data location.

Microsoft’s AI features (Copilot) are a different question. Microsoft 365 Copilot processes prompts through Azure AI infrastructure, and data handling for AI has is covered separately in Microsoft’s data protection addendum. Check the current terms at microsoft.com/en-au/licensing/product-licensing/products before relying on this for sensitive data.

Google Workspace (workspace.google.com) also offers Australian data regions for paying business customers. You can configure data region preferences in the Admin console to store covered data at rest in Australia. Not all Google services are covered, Workspace data region controls apply to Gmail, Drive, Docs, Sheets, Slides, Calendar, Meet, and Chat, but not all Google products. Google’s AI-enhanced Workspace has have separate data processing terms.

Atlassian (atlassian.com) is an Australian company headquartered in Sydney. Jira, Confluence, and related products have Australian data centre options. Atlassian Cloud Enterprise plans offer explicit data residency selection, including Australia.

Tools that process data offshore

Most consumer AI tools do not have Australian data centres. ChatGPT (OpenAI) processes data on US-based infrastructure. Claude (Anthropic) runs on AWS infrastructure, and while AWS has Australian regions, Anthropic doesn’t currently offer per-customer data residency options. Gemini (Google) follows Google’s AI data processing terms rather than Workspace data region controls.

This doesn’t make these tools unusable for Australian businesses. It means you need to be careful about what you put into them. Prompts containing personally identifiable information about clients, names, contact details, financial information, health records, create a cross-border disclosure obligation under the Privacy Act if your business is covered by it.

The Act’s small business exemption applies to businesses with annual turnover under $3 million, but this exemption doesn’t cover certain categories of sensitive information, and it doesn’t protect you from contractual obligations you may have with clients about data handling.

Practical steps for small businesses

Check where your data lives before using a new tool for anything sensitive. Most enterprise-tier tools publish a trust or security page listing their data centre locations. If the page doesn’t exist or doesn’t list Australia, assume offshore.

Use Australian data regions where they’re available and the price difference is manageable. For Microsoft 365 and Google Workspace, Australian data residency is available at standard business pricing, there’s no premium tier required.

Anonymise inputs before using offshore AI tools with client information. Instead of “draft an email about John Smith’s overdue invoice,” use “draft an email about a client’s overdue invoice for $3,200.” The AI response will be just as useful, and no personal data leaves the country.

Read the terms of service for AI has separately from the main product terms. Products like Microsoft Copilot and Google Workspace AI has have their own data handling addenda, and they’re worth reading before enabling those has for your team.

For businesses handling health records, financial services data, or anything covered by industry-specific regulations, the requirements go beyond the Privacy Act. A conversation with a lawyer who knows Australian privacy law is the right next step, not more Googling.

Sources

• Australian Privacy Act 1988: legislation.gov.au/Details/C2021C00452
• OAIC cross-border disclosure guidance: oaic.gov.au, Chapter 8
• OAIC small business exemption: oaic.gov.au/privacy/small-business
• Microsoft 365 data location: microsoft.com/en-au/microsoft-365
• Google Workspace data regions: workspace.google.com/intl/en/features/
• Atlassian Trust Centre (data residency): atlassian.com/trust/data-residency

More practical guides: How-To Hub →

📊 Compare AI tools side by side | 💼 Free resources & AI prompt packs

More on AI, law and compliance: AI, Law & Privacy Hub →