AboutFree templates
Compliance · Australia

Compliance rules for migrations: Australia

What the Privacy Act, the OAIC, ASD and the cloud providers say about moving data and systems, in plain English, with a link to the official source for every point.

Checked 8 topicsOfficial sources only
General information, not legal advice. This page covers organisations operating in Australia. We summarise what each regulator or provider publishes and link to it so you can read the source yourself. If you operate elsewhere, check your own regulator. For decisions about your obligations, speak to a privacy lawyer or your compliance team.
Privacy Act 1988

Does the Privacy Act apply to my business?

  • Most businesses and not-for-profits with annual turnover above $3 million are covered.
  • Some smaller businesses are covered regardless of turnover, for example health service providers, businesses that trade in personal information, Commonwealth contractors and AML/CTF reporting entities.
  • Australian Government agencies are covered.
For your migration: Check the full list of who is covered before you assume an exemption applies.
Official source, checked 4 Nov 2026OAIC: Small business
Australian Privacy Principle 8

Can we keep personal information in an overseas cloud region?

  • APP 8 applies when you disclose personal information to someone overseas. You generally remain accountable for how they handle it.
  • The OAIC guidelines explain when providing information to a cloud provider counts as a use rather than a disclosure, which depends on how much control you keep.
  • Choosing an Australian region reduces the question but does not settle it, because support access and some services can sit offshore.
For your migration: Map where each workload stores and processes data before you pick a region.
Official source, checked 4 Nov 2026OAIC: APP guidelines, Chapter 8 (cross-border disclosure)
Notifiable Data Breaches scheme

What if data is exposed during the migration?

  • Organisations covered by the Privacy Act must notify affected people and the OAIC about an eligible data breach, one likely to result in serious harm.
  • If you suspect a breach, you must assess it quickly. The OAIC quick reference guide sets out the steps and timeframes.
  • Wrongly shared migration folders, exported mailboxes and test copies of production data are common sources of exposure.
For your migration: Put breach response in your migration runbook and keep test data out of shared locations.
Official source, checked 4 Nov 2026OAIC: Quick reference guide for responding to data breaches
Privacy Act, from 10 December 2026

Do we need to describe automated decisions?

  • From 10 December 2026, privacy policies must explain when a computer program makes, or does something substantially related to, a decision that could significantly affect a person.
  • The policy must describe the kinds of personal information used and the kinds of decisions involved.
  • Moving to a new platform with built-in automation or AI features is a good moment to check.
For your migration: List any automated approvals, scoring or eligibility checks in the systems you migrate.
Official source, checked 4 Nov 2026OAIC: Guidance on transparency in automated decision-making
ASD Essential Eight

Is the Essential Eight mandatory?

  • It is a mandatory baseline (Maturity Level Two) for non-corporate Commonwealth entities under the Protective Security Policy Framework.
  • For everyone else ASD recommends it. Maturity Level One may suit small to medium businesses.
  • Contracts, government suppliers and cyber insurers may require a specific level.
For your migration: Design the target tenant to meet your required maturity level from day one, rather than retrofitting it.
Official source, checked 4 Nov 2026ASD cyber.gov.au: Essential Eight maturity model FAQ
IRAP

Does our cloud provider need an IRAP assessment?

  • IRAP assessors evaluate systems against the Australian Government Information Security Manual.
  • Government agencies and their suppliers often ask for a provider's IRAP assessment when buying cloud services.
  • Major providers publish which services were assessed and at what classification.
For your migration: Ask each provider for its current IRAP report and check that the services you will use are in scope.
Official sources, checked 4 Nov 2026ASD cyber.gov.au: IRAPMicrosoft Learn: Australia IRAP compliance offering
Data residency

Is Microsoft 365 data stored in Australia?

  • Microsoft lists Australia as a local datacentre geography and documents which services store customer data at rest there.
  • You can see your tenant's data location in the Microsoft 365 admin center under Settings, Org settings, Organization profile, Data location.
  • Commitments vary by service. Advanced Data Residency and Multi-Geo add further commitments.
For your migration: Check the data location page for every service you rely on, including add-ons and third-party apps.
Official sources, checked 4 Nov 2026Microsoft Learn: Where Microsoft 365 data is storedMicrosoft Learn: Microsoft 365 data residency overviewMicrosoft Learn: Advanced Data Residency
Power Platform

Where do Power Platform environments live?

  • Power Platform environments are created in a region you choose, and Australia is available.
  • Moving an environment to another region later is not a simple setting, so choose before you build.
For your migration: Set the default environment region before users start building apps and flows.
Official source, checked 4 Nov 2026Microsoft Learn: Power Platform in Microsoft Cloud Australia