AI Tool Data Residency Comparison: Where Your Data Actually Goes

If you've started using AI tools in your business and you're not sure where your data actually ends up, you're not being paranoid, you're being responsible. Most Australian business owners who use ChatGPT, Microsoft Copilot, or a built-in AI feature in their existing software have no idea which country their data is processed in, whether it can be used to train the vendor's AI models, or what that means under Australian privacy law. This guide answers those questions in plain language, so you can make an informed decision about which tools are acceptable for your business, and which ones come with conditions you need to know about first.

Why Data Residency Matters for Australian Businesses

Data residency refers to the physical location where data is stored and processed. When you type a client query into ChatGPT, upload a document to an AI tool, or use an AI feature inside your CRM, that data travels somewhere. The question is: where?

For most people, this feels like a technical detail. But for Australian businesses that handle personal information, it is a legal question with real consequences. The Australian Privacy Act 1988 applies to businesses with an annual turnover above $3 million, and to certain smaller businesses in health, credit reporting, and other regulated sectors. If your business is covered, the law sets rules about how personal information is handled, including when it leaves the country.

Personal information includes more than obvious things like names and email addresses. Client notes, employee records, meeting transcripts, support tickets, and sales conversations can all contain personal information. If any of that passes through an AI tool, data residency becomes relevant immediately.

Take a physiotherapy clinic owner running a practice with three practitioners. Her admin team used to paste client intake notes, injury history, referring GP details, and medications, straight into ChatGPT on the free plan to save time drafting summaries. Now she keeps that data inside Microsoft 365 Copilot instead, where her practice already has a Data Processing Agreement and an Australian data centre, and only uses ChatGPT for generic, non-identifying drafting tasks. That's the difference between a shortcut that felt harmless and a Privacy Act exposure she didn't know she had.

What APP 8 Actually Says

Australian Privacy Principle 8 (APP 8) covers cross-border disclosure of personal information. In plain terms, it says this: before you send personal information to someone in another country, you need to take reasonable steps to make sure that recipient will handle it in a way that is consistent with the Australian Privacy Principles.

This matters for AI tools because sending a prompt that contains client data to a US-based AI service is, in most interpretations, a cross-border disclosure. The Office of the Australian Information Commissioner (OAIC) has confirmed that cloud services storing data overseas are subject to APP 8 obligations. If the overseas AI vendor has a data breach or misuses the data, your business may still be held accountable.

There are two ways a business can satisfy APP 8. First, ensure the overseas recipient is subject to a law or binding scheme that is substantially similar to the APPs. Second, get the individual's consent to the disclosure, with an acknowledgement that APP 8 protections will not apply. Neither of these is always straightforward with off-the-shelf AI tools.

The Comparison Table: Where Each Tool Stores Your Data

The table below summarises data residency, Australian data centre availability, training opt-out options, and whether enterprise tier is needed to access meaningful privacy controls. This table is verified as of June 2026 and is updated monthly. All details are drawn from each vendor's official documentation, data processing agreements, and privacy policies.

What This Table Means for Your Privacy Act Obligations

Reading the table above, a few things stand out for Australian businesses. First, most tools default to US-based data processing. Microsoft and Google are the clearest exceptions, offering genuine Australian data centre options, but only on paid commercial plans, not free consumer tiers. Second, training data opt-outs are generally available, but you often have to find and enable them yourself. They are not always on by default for every plan.

Third, and most importantly, meaningful compliance controls (data processing agreements, data residency commitments, audit logs, zero data retention) almost always require enterprise or higher-tier plans. If your business is on a basic or free plan, you may have fewer privacy protections than you realise.

Under APP 8, your business is responsible for personal information that crosses borders, even if a vendor's terms say they handle it responsibly. The practical standard the OAIC applies is whether you took reasonable steps before sending that data offshore. Checking whether a vendor has a Data Processing Agreement (DPA) available, and signing it, is one of those reasonable steps. Relying on a free consumer tier with no DPA is not.

For a deeper look at what the Privacy Act actually requires, and how APP 8 applies specifically to your business, see our guide to AI and the Privacy Act in Australia.

Two Tools That Stand Out on Data Residency

Microsoft Copilot (via Microsoft 365) is currently the clearest option for Australian businesses that need AU data residency. Azure has data centres in Sydney and Melbourne, and Microsoft 365 commercial plans include a Data Processing Agreement as standard. If your business already uses Microsoft 365, the data residency question for Copilot is more manageable than for most alternatives.

Google Workspace AI (including Gemini for Workspace) is the other option with genuine AU data region controls, though the scope of what data stays in Australia versus what is processed in the US for AI inference is worth examining in Google's current documentation before you rely on it.

All other tools in this table process data in the US. That does not make them unusable for Australian businesses, but it does mean you need to take additional steps: sign a DPA where one is available, avoid inputting sensitive personal information into consumer-tier tools, and document your risk assessment. For guidance on what to look for in vendor contracts before you sign, see our guide on AI vendor contracts and the Privacy Act.

What to Do if Your Current Tool Is US-Based

If you are already using a US-based AI tool with business data, here are the practical steps to take. Start by checking whether the vendor has a Data Processing Agreement available and whether your current plan gives you access to it. Many vendors offer DPAs on paid plans but not free ones.

Next, check whether you have turned off training data use. On most tools, this is a toggle in account or workspace settings, and it is worth confirming rather than assuming it is off by default.

Then, consider what type of data you are actually putting into the tool. There is a meaningful difference between using ChatGPT to draft a generic email template and using it to summarise a client intake form that contains sensitive health or financial information. If you are doing the latter, you need stronger controls than a standard consumer plan provides.

Finally, if you are in a regulated sector, such as health, legal, financial services, or education, the bar is higher. Some professions have their own obligations on top of the Privacy Act, and simply relying on a vendor's standard terms may not be enough. See our specific guide on using customer data with ChatGPT in Australia for the healthcare and professional services context.

A Note on the Training Data Opt-Out

Training data opt-out and data residency are two separate things. Opting out of training means your data is not used to improve the vendor's AI models. It does not change where your data is processed, how long it is retained, or what happens to it in the event of a breach.

Both matter, but they answer different questions. Data residency answers: where does my data go? Training opt-out answers: will my data be used to make the AI smarter for other users? For Australian Privacy Act compliance, data residency is the more critical of the two, because it determines whether APP 8 obligations are triggered. Training opt-out is still important for commercial confidentiality reasons, even if it is not the primary legal compliance question.

Practical Checklist Before You Use an AI Tool with Business Data

Before you pass client, employee, or business data through any AI tool, work through these questions. They will tell you whether your current setup is likely to satisfy APP 8 and general Privacy Act obligations.

Related reading: AI tools with Australian data centres, HR AI compliance in Australia, free AI staff policy template, AI data breaches and the NDB scheme, Claude AI review for Australian business, Notion AI review for Australian business, and Microsoft Copilot pricing in Australia.

Related reading: our where your AI tool stores its data.

Try our free AI Privacy Risk Scorer to score your current AI tool setup against Privacy Act requirements.

Related reading: our privacy-first cloud storage for Australian business.

For the broader data sovereignty picture, including the difference between residency and sovereignty, see our data sovereignty hub.

Does using ChatGPT with client data breach the Privacy Act?

It depends on how you use it and what plan you are on. Using ChatGPT to draft a generic document that contains no personal information is unlikely to raise Privacy Act concerns. Pasting a client record, health note, or financial detail into ChatGPT on a free or standard plan, without a signed Data Processing Agreement and with data processed on US servers, creates a real APP 8 exposure. For the full analysis of this specific question, see our guide on using customer data with ChatGPT in Australia.

What is a Data Processing Agreement and do I need one?

A Data Processing Agreement (DPA) is a contract between your business and the AI vendor that sets out how your data will be handled, what security measures apply, what happens in a breach, and how long data is retained. If your business is covered by the Privacy Act and you are sending personal information to an AI tool, a DPA is the primary contractual mechanism for satisfying your APP 8 obligations. Most vendors offer DPAs on paid commercial plans. If a vendor does not offer one, that is a significant risk flag for compliance purposes.

Is Microsoft Copilot safer than ChatGPT for Australian businesses?

For data residency specifically, yes. Microsoft 365 commercial plans give Australian businesses access to Azure data centres in Sydney and Melbourne, and a Data Processing Agreement is included as standard. ChatGPT on standard plans processes data in the US with no AU data centre option. That said, "safer" depends on your specific use case, what data you are handling, and whether you are on the right plan. For sensitive regulated data, you should assess both tools against your specific obligations, not just compare data residency at a headline level.

Does turning off training opt-out fix my Privacy Act compliance?

No. Opting out of AI model training is a separate question from data residency. Disabling training means your data is not used to improve the vendor's models, but it does not change where your data is processed, how long it is stored, or how it is protected. For APP 8 compliance, the location where data is processed and the legal protections that apply in that jurisdiction are what matter. Training opt-out addresses a commercial confidentiality concern, not the primary cross-border disclosure obligation.

Do free plans of AI tools comply with Australian privacy requirements?

Generally, no, not for business use involving personal information. Free consumer plans typically do not include Data Processing Agreements, may use your data to improve AI models by default, and do not offer data residency controls. If your business is covered by the Privacy Act and you are processing personal information through an AI tool, a paid commercial plan with a DPA is the minimum baseline. Free plans may be acceptable for tasks that involve no personal information at all.

Which AI tools have an Australian data centre?

As of June 2026, Microsoft Azure (used by Microsoft 365 Copilot and Azure OpenAI) has data centres in Sydney and Melbourne. Google Cloud (used by Google Workspace AI and Gemini for Workspace) also offers an Australia region for data at rest. Salesforce has an AP Southeast region for data at rest, though AI inference processing may still occur in the US. ChatGPT / OpenAI, Claude / Anthropic, Notion AI, Zoom AI Companion, and HubSpot Breeze do not have Australian data centres at any tier as of this writing.