In Brief
Amazon and Microsoft have announced A$45 billion of spending on Australian cloud infrastructure by 2029. Keeping data in an Australian region settles where it sits. It does not settle which foreign laws can reach it, who can change how the platform behaves, or what leaving would cost. Before the next cloud renewal, boards should classify material workloads on those questions, pay for certified hosting only where the answers demand it, and contract exit terms.
An Australian postcode settles only where the data sits
In 2025 we advised an unnamed financial-services client through a post-incident review. It had moved its analytics systems into an Australian region of a global cloud platform, partly to meet its own data-residency policy.
During the incident, the team found the platform’s control plane, its telemetry pipeline and the engineers with authority to change it operated from three other jurisdictions. The control plane is the systems and people who can change how a platform behaves. Telemetry is the monitoring data it reports about itself.
The data had never left Sydney; operational authority had never arrived.
At the next renewal the client fixed the contract. The clause now names the operating jurisdictions, the legal entities and the audit rights.
One engagement is not a rule. The gap it exposed is still worth checking, because much more local capacity is on the way.
Amazon has announced A$20 billion for Australian infrastructure over 2025 to 2029, and Microsoft A$25 billion by the end of 2029. That is A$45 billion of announced spending, nearly two and a half times the A$18.2 billion in their earlier programmes.
The risk is that a board reads that spending as sovereignty delivered. Sovereignty is four questions: where the data sits, who controls the systems around it, which laws can reach it, and what it would cost to leave. An Australian postcode settles only the first.
Residency and sovereignty buy different things
An Australian region delivers
- Physical data location
- Lower latency for local users
- Support for data-residency requirements
- Access to certified hosting options
It does not by itself deliver
- Immunity from foreign legal demands
- An onshore control plane or support team
- Customer control of encryption keys
- Exit terms nobody has contracted
That makes the gap a board matter. At a listed company, an outage prolonged by an offshore control plane may need assessing for continuous disclosure. The ASX rule covers information a reasonable person would expect to have a material effect on the price or value of the company’s securities, subject to exceptions.
The next renewal is when the terms are open. Before then, the board needs to understand why the postcode falls short, and what the alternatives cost.
The law reaches past the postcode, and the alternatives are hard to price
The pull toward local hosting is real. Data gravity, a term coined by Dave McCrory in 2010, describes applications and services clustering around large stores of data. The chart shows how much money is now following it.
The law does not follow the data onshore. Under the US CLOUD Act, a provider subject to US jurisdiction can be lawfully required to produce data it controls, even data held in Sydney. Legal process applies and providers can challenge demands. The postcode still does not stop them.
What changes the exposure is the provider’s corporate structure, who holds the encryption keys, and what the provider may lawfully tell its customer about a demand. None of those is a location.
Australian law adds a second exposure. When a company discloses personal information to a recipient overseas, the Privacy Act can keep it accountable for how that recipient handles it. That depends on the facts, and exceptions exist. Offshore engineers reaching data held in Sydney can raise a privacy question too.
Labels can mislead as well. Under IRAP, a government security programme, an assessor checks a system against the government’s cyber security controls. The customer agency then decides whether to accept the risk. An assessment is not a certification, so a provider calling itself “IRAP certified” is describing the process wrongly.
The government’s Hosting Certification Framework does certify. But its register includes the global providers’ Australian services, and it does not show where a service’s control plane runs. It is where the board’s questions start.
US CLOUD Act. A provider subject to US jurisdiction can face lawful demands for data in its possession, custody or control, wherever the data is stored. Legal process applies, and providers can challenge demands.
Overseas disclosure (APP 8 and section 16C, Privacy Act 1988). In force since 12 March 2014. A company covered by the Act that discloses personal information to an overseas recipient can generally be held accountable for how the recipient handles it. Exceptions apply. Where a provider only stores or accesses data under binding limits, and the company keeps effective control over how the information is handled, that may not count as a disclosure.
Statutory privacy tort. A separate right for individuals to sue for a serious invasion of privacy, added by the 2024 amendments, commenced on 10 June 2025. It is a court remedy for individuals, and it does not govern offshore handling as such.
IRAP and the ISM. Under the Australian Signals Directorate’s IRAP programme, registered assessors test a system against the Information Security Manual (ISM). Their report informs the customer agency’s own authorisation decision.
Hosting Certification Framework. Certifies hosting providers and cloud services for government use in two tiers, Certified Assured and the stricter Certified Strategic, which address who owns and controls the provider. AWS, Microsoft Azure and Google Australian services appear on the public register, which does not show control-plane or dependency detail. Registrations were paused on 3 November 2025 during reform; existing certifications were unaffected.
If the postcode is not enough, two alternatives are on offer: bringing workloads back from public cloud, or paying for sovereign hosting. Both are harder to judge than they look.
Repatriation means moving workloads to the company’s own or dedicated servers. A survey published by Citrix in February 2024 found 94 per cent of 350 US IT leaders had been involved in such a project over three years.
That is more than nine in ten. It measures involvement in a project, though, and its sample was American, so it cannot tell a board what Australian companies have actually moved. A workload flagged for review in a survey response is not a workload rehomed.
Sovereign hosting is usually sold as certified or dedicated local arrangements, and each still needs checking against the controls above. No standard premium for it has been established. Where one exists, it may sit in the terms as well as the price. Management should check for minimum spend, security-cleared support staff, fewer services and less room to scale.
None of this can be settled for the whole estate at once. It has to be settled workload by workload, before the contract renews.
Classify before the renewal, and pay for sovereignty only where needed
Classify material workloads on four lenses. We recommend scoring each material workload on legal exposure, operational control, concentration and reversibility.
In board language, legal exposure is a disclosure scenario with a cost attached, and control is who can change system behaviour during an incident. Concentration is a named single point of failure, such as one provider, region or facility; reversibility is a priced exit.
The chief information officer and chief risk officer should run the classification, and the board should approve it before the next major renewal. How many workloads it moves will vary. The aim is to turn a debate about sovereignty into a portfolio decision with prices attached.
Pay the premium only where the classification demands it. For each workload rated high, the CFO should see it priced in a standard cloud region and in a certified or dedicated arrangement. The board then approves the difference as a line item, workload by workload.
Contract reversibility at renewal. Procurement and general counsel should settle exit terms before signing. The terms cover exit costs, egress fees (charges for moving data out) and help with the transition. They also cover escrow, where an independent party holds critical data or code for release on agreed triggers.
They should also check any fee waiver for leaving, its conditions, and whether the contract makes it enforceable. A twelve-month exit test, priced each year alongside the annual audit, keeps the number current.
Verify the control plane, not the brochure. For workloads rated high on legal exposure or control, the chief information security officer should get evidence of where the control plane, telemetry and support engineers operate.
Start with the provider’s standard terms and the documents they incorporate, then request in writing whatever they leave out, such as operating locations and audit rights.
The financial-services review above turned on facts nobody had asked for when the contract was signed. Asking costs a clause; discovering costs an incident.
Buying only the sovereignty the company needs
| Action | Owner | Timeline | Priority |
|---|---|---|---|
| Classify material workloads on legal exposure, operational control, concentration and reversibility, and bring the result to the board for approval | CIO with chief risk officer | Before the next major cloud renewal | critical |
| Price each high-rated workload in a standard region and a certified or dedicated arrangement; approve any premium workload by workload | CFO | With the classification | high |
| Negotiate exit costs, egress fees, transition help and escrow; run a priced twelve-month exit test each year | Chief procurement officer with general counsel | Each renewal; exit test annually | high |
| Obtain evidence of control-plane, telemetry and support locations and legal entities for every workload rated high on legal exposure or control | CISO | Next procurement round | high |
The next renewal date sets the timetable. At its next meeting, the board should ask management when the largest cloud contract renews, and set the classification’s due date before it.
Question for management: when does our largest cloud contract renew, and will the four-lens classification be approved before it does?
Updated September 2026: figures refreshed and the argument sharpened since first publication on 25 July 2026.
Questions for Leadership
Which of our material workloads could a foreign court or agency lawfully reach, by provider and jurisdiction?
The answer turns on the provider's corporate structure and who holds the encryption keys.
If we had to leave our main cloud provider within twelve months, what would it cost and what would break?
An exit nobody has priced cannot be negotiated at renewal.
Where do the control plane, telemetry and support engineers for our most sensitive workloads operate, and under which legal entities?
These are the systems and people that can change the platform during an incident, wherever the data sits.
Which workloads justify paying for certified or dedicated hosting, and what does the difference cost?
Without a priced comparison, the board is approving a premium it cannot see.
Where we send personal information to recipients overseas, who owns that accountability, and could we evidence it tomorrow?
APP 8 and section 16C can keep the company accountable for an overseas recipient, subject to exceptions.
The Bottom Line
Before the next cloud renewal, have management classify every material workload by legal exposure, operational control, concentration and reversibility. Approve the certified-hosting premium only for the workloads that classification names, and contract exit terms and control-plane evidence before signing.
Frequently Asked Questions
What reduces exposure to foreign legal demands when a US provider holds the data?
Controls can limit what a provider is able to hand over; they do not change which law applies to it. The main levers are the provider's corporate structure, encryption keys held outside the provider's reach, contract terms on telling the customer about a demand (which foreign law may restrict), and keeping less sensitive data in the service. For each high-exposure workload, management should state which of these are in place and what a lawful demand could still produce.
Is cloud repatriation actually happening?
Some movement is measurable, but the surveys cited here do not show how much has actually left. Besides the Citrix survey, a Liquid Web study with fieldwork in May 2025 found that 42 per cent of 1,009 IT professionals, about two in five, reported moving workloads to dedicated servers in the previous 12 months. The surveys use different samples, periods and definitions, and Australian outcomes cannot be read straight from them. The better question is which workloads, if any, no longer belong where they are. Candidates worth testing are steady workloads with predictable use, data-heavy systems with high egress fees, and workloads reclassified for legal reasons.
How large is the sovereign hosting premium?
There is no established standard figure, so treat any confident percentage with caution. Some Australian sovereign providers, such as Amaze, publish some prices, and Oracle advertises service and price parity between its sovereign and public clouds. Neither gives the board a benchmark for its own estate. The practical approach is to price the same workload in a standard region and in each certified or dedicated offer, then compare total cost over the contract term. That comparison should include minimum commitments, support staffing, the range of services on offer and the ability to scale up quickly.
What does a twelve-month exit test involve?
It is a desk exercise, repeated each year, that prices leaving the main provider within twelve months. Management lists what would move, in what order and to where. It estimates data-transfer fees, parallel running, rebuilt integrations and staff time, and names what would break. It also checks any fee waivers for leaving and their conditions: AWS, for example, has offered free data transfer out to customers moving away since March 2024, subject to eligibility. The output is a cost range and a list of blockers that procurement can take into the next renewal.
What should the workload classification give the board?
A short decision paper, not a spreadsheet dump. It should list the material workloads, rate each one on legal exposure, operational control, concentration and reversibility, and name an owner for each. It should single out the few rated high, with each priced in a standard region and in a certified or dedicated arrangement, and give an exit cost range for the main providers. It should end with the decisions the board is being asked to make before the renewal, and the date by which each is needed.