Residency obligations reach further than storage location: where data lives, who can reach it, where it travels, what disclosures are permitted, where backups and disaster recovery copies sit, which sub-processors touch it, and who can authorise the keys that protect it. “Stored in Australia” is the smallest part of the obligation.

The five questions, in order

  • Classification. Which data classes carry obligations? Make “Australian-regulated data” a first-class, testable category.
  • Obligation. What attaches to each class — statutory (Privacy Act and APPs, sector regimes), then contractual from enterprise customers, which usually exceed the statutory floor.
  • Location. Region policy by class, covering primary storage, backup, disaster recovery and analytics paths — where naive designs fail.
  • Access. Controls and logging on cross-border administrative access. Regulators increasingly ask who could have moved the data, not where it sits.
  • Custody. Keys in Australian control, with break-glass procedures that do not route through offshore roles.

Three implementation patterns

  • Regional partitioning. Australian-regulated data isolated at storage and encryption layers, tenant routing enforced at ingress. Carried a fintech licensing engagement to sign-off in five months without re-platforming.
  • Controlled replication. Classification-driven export for international operations, with the Australian source of truth anchored onshore.
  • Sovereign enclave. Full Australian custody including operations, for government and defence-adjacent supply chains.

In all three, residency should be enforced by the platform — tagging, guardrails, pipeline checks that make offshore placement of regulated classes difficult, not merely forbidden — and evidenced by telemetry rather than assembled by hand.

Contract clauses that hold the chain

  • Sub-processor itemisation with obligations flowed down the chain.
  • Location commitments covering primary, backup and disaster recovery, with change notification.
  • Transparency on lawful access requests in vendor jurisdictions, with notification where law permits.
  • Key custody and access logging, aligned to the engineering answer.
  • Exit and portability: usable egress on defined timelines, with deletion evidence.

Timing

Residency questions arrive with licensing applications, enterprise pursuits and regulatory requests. Answered on a whiteboard they cost days; answered under deadline they cost programmes — a vendor quote of nine months and a re-platform was replaced by five months of engineering in the fintech engagement above. Run the five questions before the deadline runs you.