Sovereign Cloud in Australia: What It Means and Who Qualifies

Why "sovereign cloud" means different things

Ask five providers what sovereign cloud means and you may get five answers. For one it is a cloud region located in Australia. For another it is a service run only by Australian staff. For a third it means an Australian-owned company whose data centres, staff and control systems all sit onshore. All three get marketed with the same word.

There is no single legal definition of sovereign cloud in Australia. That is why it pays to break the term into the separate things it can cover, then decide which of them your workload actually needs. Our guide to government data centre requirements explains the Hosting Certification Framework and IRAP in detail. This guide steps back to the broader question every buyer faces: what does sovereignty mean for my data, and who really needs it?

Data residency, data sovereignty and operational sovereignty

It helps to separate three ideas:

• Data residency is about where data is physically stored and processed. An Australian region or an Australian colocation facility gives you residency, as long as backups, replicas and support tooling stay onshore too. • Data sovereignty is about which country's laws can reach the data. Data stored in Sydney is subject to Australian law, but it may also be reachable under foreign law if the provider holding it is subject to another country's jurisdiction. • Operational sovereignty is about who can access and run the systems: where the administrators sit, whether they hold Australian security clearances, and whether the control plane (the management systems used to configure and operate the service) can be reached from overseas.

A service can tick the first box and not the others. That is the most common gap between a sovereign label and a sovereign service.

Ownership, foreign law and the control plane

Ownership matters because of foreign law. The best-known example is the United States CLOUD Act of 2018, under which US authorities can require providers subject to US jurisdiction to produce data in their possession, custody or control, even when it is stored outside the United States. Australia and the United States also have a data access agreement for investigating serious crime, signed on 15 December 2021 and in force since 30 January 2024. It allows each country's agencies to seek orders for data held by communications service providers in the other country, with safeguards set out in the agreement.

None of this means a global provider is unsuitable. Many government and regulated workloads run on global platforms in Australian regions. It does mean that "the data is in Australia" does not fully answer the jurisdiction question, and buyers with sensitive data should understand who owns the provider, where it is incorporated, and whether its staff or systems overseas can reach the environment.

The control plane deserves particular attention. If identity, monitoring, support access or encryption key management run from overseas, data can be resident in Australia while operational control is not. Ask where each of these sits, and whether you can hold your own encryption keys.

Which rules actually require sovereign hosting

Most Australian businesses have no general legal requirement to keep data onshore. The obligations that do exist are specific:

• Privacy Act. Under Australian Privacy Principle 8, before an organisation discloses personal information to an overseas recipient it must take reasonable steps to ensure the recipient does not breach the privacy principles, and it can remain accountable for how that information is handled. This does not ban offshore storage, but it adds contracts, due diligence and risk. • My Health Record. Section 77 of the My Health Records Act 2012 prohibits holding or processing My Health Record system records outside Australia, with only narrow exceptions, and breaches carry criminal and civil penalties. • Critical infrastructure. Under the Security of Critical Infrastructure Act 2018, a data storage or processing asset can itself become a critical infrastructure asset when it is used wholly or primarily to provide services to government, or to provide services relating to "business critical data" to the responsible entity for a critical infrastructure asset. Business critical data includes personal information about at least 20,000 individuals. Responsible entities must tell their data storage provider when it is storing or processing business critical data for them. • Government. Agencies hosting sensitive or PROTECTED data look to the Hosting Certification Framework, which focuses on who owns and controls the provider and its supply chain. The framework's website notes that new provider registrations were paused from 3 November 2025 while it is reformed, so check the current status before relying on it.

Contracts can add their own requirements. Government suppliers, banks and health providers often pass data location clauses down to their suppliers, so check your customer contracts as well as the law.

Who qualifies as a sovereign provider

Because there is no single definition, "qualifies" depends on the standard you are measuring against. For government work, the clearest benchmark is a provider and service certified under the Hosting Certification Framework, together with an IRAP assessment of the specific service. Strategic certification is only available to providers that let the government specify ownership and control conditions. For private sector buyers, a practical test is whether the provider can show onshore residency for all copies of your data, Australian-based operations and support, a clear ownership structure and jurisdiction, and contractual commitments that back all of this up.

Colocation adds another layer. If you run your own equipment in an Australian data centre, you control the servers, the encryption and the administrator access, which can give you a high degree of sovereignty without relying on a cloud provider's claims. Many organisations use a hybrid approach, keeping sensitive systems in colocation and connecting to cloud through cloud on-ramps. Facilities in Canberra and Sydney are common choices for government-adjacent work, and our guide to physical security and compliance covers what to check on site.

Questions to ask providers

Use these in your request for proposal:

1. Where are all copies of our data stored and processed, including backups, replicas, logs and disaster recovery? 2. Who owns your company, where is it incorporated, and could any foreign law compel you to provide access to our data? 3. Where are your operations and support staff located, and do any hold Australian security clearances? 4. Where does the control plane run, and can anyone outside Australia access our environment? 5. Can we hold and manage our own encryption keys? 6. Which certifications and assessments apply to the exact service and site you are offering, and can you provide the Certification ID or assessment report? 7. Will you commit to data location and access terms in the contract, and how will you notify us of a change in ownership?

Record the answers side by side in the comparison tool and look up operators in the provider directory.

Find a provider that fits your sovereignty needs

Sovereignty is one requirement alongside location, power, connectivity and price. DChunt's free assessment lets you flag data residency and sovereignty requirements, so your shortlist only includes operators that can meet them. DChunt is independent and does not resell data centre space. This guide is general information, not legal advice.