The honest picture of Australian data residency for AI — where keeping data onshore is a legal requirement versus a risk and procurement preference.
dgm is an independent osFoundry integration partner — not affiliated with osFoundry’s maker (OS LLC), and dgm has no completed client integrations yet.
‘Keep our data in Australia’ is a common AI requirement, but the legal reality is more nuanced than many assume. Here is when Australian data residency is actually required versus a sensible preference.
| Item | Detail |
|---|---|
| Private sector | No general data-localisation law (Privacy Act = accountability model) |
| Overseas disclosure | APP 8 — you stay accountable for the overseas recipient |
| Government data | Hosting Certification Framework + IRAP for classified data |
| Practical driver | Sensitive data, sovereignty, procurement and sector expectations |
What the law actually says
Australia has no general private-sector data-localisation law. The Privacy Act, via APP 8, uses an accountability model — you remain responsible for an overseas recipient’s handling of personal information. The stricter residency regimes are for government data: the Hosting Certification Framework and IRAP-assessed environments apply to data classified PROTECTED or above.
When residency really matters
Australian data residency is most often a requirement for government, critical-infrastructure, health, and other sensitive or procurement-driven contexts rather than a blanket statutory mandate. For those workloads, keeping data onshore is a genuine control; for others it is a reasonable preference.
How to achieve it
osFoundry’s managed cloud pins data to the US, EU or Japan — it does not currently offer an Australian managed region. For data that must stay in Australia, the honest path is self-hosting osFoundry (BYO Cloud) inside an Australian cloud region such as AWS (Sydney or Melbourne), Microsoft Azure (Australia East, Australia Southeast or Australia Central in Canberra) or Google Cloud (Sydney or Melbourne), or running models locally on-device. That gives you a real Australian-residency option for sensitive workloads while keeping model choice. Be precise in your claims — overclaiming a legal mandate that does not exist undermines trust.
Where dgm fits
dgm is an independent integration partner that helps Australian businesses adopt osFoundry — scoping a first use case, handling the build, and connecting AI to the systems you already run. dgm is independent of osFoundry’s maker (OS LLC) and has no completed client integrations yet, so everything described here is a service offered, not a past result. If you want to scope a practical first project, dgm can help you map it out.