Every business website stores something. It might be contact form messages, customer accounts, order details or a mailing list. That information sits on servers run by a hosting or cloud provider, and those servers can be almost anywhere. Knowing where your data lives is a sensible part of choosing a host.
This article looks at why location matters for Australian businesses. It covers the Privacy Act, the overseas disclosure rules and the shared responsibility model for cloud services. It also suggests questions to put to any provider. It is general information only, and the rules can change.
Why the location of your data matters
Customer details are valuable, both to your business and to people who should not have them. Data used to personalise customer experiences often includes names, purchase history and contact details. Where that data is stored affects which laws apply to it and who can reach it. It also shapes how you answer customers who ask what happens to their information.
The Australian Government publishes cloud shared responsibility guidance for small and medium businesses. It advises using only cloud services located in countries that are suitable for the sensitivity of your data. That includes the provider’s support staff, not just its servers. So it is worth asking where support staff are based as well as where the servers sit.
Does the Privacy Act apply to your business?
The Office of the Australian Information Commissioner (OAIC) regulates privacy under the Privacy Act 1988. The OAIC explains that a small business is one with an annual turnover of $3 million or less. Many small businesses fall outside the Act. However, some are covered regardless of turnover.
Businesses covered regardless of turnover include health service providers and businesses that trade in personal information. Contractors providing services under a Commonwealth contract are also covered, along with credit reporting bodies and some others. A small business can also choose to opt in to the Act. The OAIC suggests small businesses consider opting in, and lists greater customer trust among the benefits.
Even if the Act does not apply, its principles are a fair benchmark. Customers are more likely to share their details with a business that handles them with care. Trust is one of the psychological triggers that improve conversions on a website. A clear explanation of where data is stored can support that trust.
Overseas hosting and Australian Privacy Principle 8
For businesses covered by the Act, Australian Privacy Principle 8 deals with cross border disclosure of personal information. Before disclosing personal information to an overseas recipient, a business must take reasonable steps so that the recipient does not breach the principles. The OAIC says it is generally expected that this will involve an enforceable contract. What counts as reasonable depends on how sensitive the information is and the possible harm if it is mishandled.
Section 16C of the Act makes the Australian business generally accountable for a breach by the overseas recipient. The OAIC says this can apply even where reasonable steps were taken. That is a strong reason to read hosting contracts closely. A low price offshore looks less attractive if your business carries the risk.
Is cloud hosting a use or a disclosure?
The OAIC guidance on sending personal information overseas explains that using an overseas cloud provider may be a use rather than a disclosure in limited cases. The provider must handle the data only for storage and access, and the business must keep effective control. Control factors include who can access, change or retrieve the data, and whether it can be permanently deleted when the contract ends. Where it is unclear, the OAIC suggests treating the transfer as one that needs reasonable steps.
The OAIC also says the Privacy Act does not prevent a business from using a cloud provider to store data overseas. Security obligations under APP 11 still apply. APP 1 requires the privacy policy of a covered business to include information about likely overseas disclosures. If your host or software stores data offshore, check that your privacy policy says so.
Exceptions to the overseas rule
APP 8 includes some exceptions to this duty. One applies where the business reasonably believes the recipient is bound by a law or scheme at least substantially similar to the principles. People must also have a way to enforce it. Another applies where a person consents after being expressly told the principle will not apply. These exceptions have conditions, so get advice before relying on them.
The shared responsibility model
Moving a website to the cloud does not hand over all the risk. The government cloud guidance makes this point directly, saying you cannot outsource that risk to a provider. It says the provider is responsible for cloud services that are securely designed, set up and operated. The customer still controls who can access the data and must look after its own accounts and software.
Some tasks fall to either side depending on the service. These include multifactor authentication, secure settings, logging and backups. The guidance recommends phishing resistant multifactor authentication when accessing cloud services. It also suggests choosing a provider that publishes shared responsibility documentation for each service.
Questions to ask a hosting or cloud provider
The same guidance lists practical questions about backups, logins and logs. Use them alongside your own questions about location and what happens to your data when a contract ends. A good host will answer them plainly and in writing. These are the main points to cover.
- In which countries are your servers, backups and support staff located?
- Do you back up my data, or do I need to, and are backups automatic and free?
- Are backups protected from unauthorised change or deletion, and can I restore them myself?
- Can I restore earlier versions of my site and data?
- Will you alert me to logins from unfamiliar devices, and are logs available at no extra cost?
- Can I retrieve and permanently delete my data when the contract ends?
Ask the same questions of any tool that touches customer data. Booking systems, online forms and email marketing platforms often store details on their own servers. Each of these may sit in a different country to your website host. Keep a simple list of where each service stores data.
Moving files to a new host is also a good moment to review security. If you still upload site files by FTP, read up on the different FTP connection modes and ask whether an encrypted method is available. Your host can tell you which secure transfer methods it supports. The government cloud guidance also warns against storing passwords and other secrets in code or configuration files.
Frequently asked questions
Is it illegal to host my website overseas?
No, the OAIC says the Privacy Act does not prevent using an overseas cloud provider to store data. Businesses covered by the Act still have obligations under APP 8 and APP 11. In many cases they also remain accountable for how an overseas recipient handles the data. Check your contract and privacy policy carefully.
Does the Privacy Act apply to small businesses?
Generally not, if annual turnover is $3 million or less. Some businesses are covered regardless of turnover, such as health service providers. Small businesses can also choose to opt in. The OAIC website has a checklist to help you work it out.
What should my privacy policy say about overseas storage?
APP 1 requires a privacy policy to include information about likely overseas disclosures. If a provider stores data offshore, say so plainly. Review the policy when you change hosts or add new software. Get advice if you are unsure what to include.
Who is responsible for security in the cloud?
The provider and the customer share it. The provider looks after the secure design and operation of its services. The customer controls access, accounts and its own software. Backups and multifactor authentication can fall to either side, so check the documentation for each service.
This article is general information only and is not legal advice. Privacy laws and guidance change, and other laws may apply depending on your industry and the state or territory you operate in. Speak with a qualified lawyer about your own situation.