Articles & InfographicsPerspectives AIAzureData Governance EnterpriseFederal GovernmentHigher Education and VETState Government Cyber SecurityPolicyRisk and Issue Management

Who really controls your organisation’s data?

21.07.2026

For organisations handling sensitive information, data sovereignty is increasingly a question of accountability, trust and executive oversight.

Data sovereignty has moved from a technical consideration to a core leadership issue across both the public and private sectors. Governments, universities and regulated industries hold highly sensitive personal and commercial information. Private sector organisations increasingly rely on data to drive growth, automate decisions and compete on insight. In both cases how data is stored, governed and protected directly shapes public confidence, customer loyalty and organisational reputation.

At its core, data sovereignty refers to the principle that data is subject to the laws of the country in which it is physically stored. For Australian organisations, this matters because offshore storage can expose data to foreign legal regimes that do not align with Australian privacy, records management or disclosure expectations. Accessing data from Australia does not change this reality. Jurisdiction follows location.

A useful way to think about this is a digital passport. Australians travelling overseas remain under Australian protection because of their passport. Data works in a similar way. If critical data does not effectively carry the equivalent of an “Australian passport”, organisations may lose control over who can access it, and which laws ultimately apply.

The drivers for getting this right are not limited to compliance. In the public sector, weak data sovereignty undermines accountability to citizens, students and researchers. Breaches or inappropriate disclosures can quickly escalate into ministerial issues, regulatory action and loss of public trust. In the private sector, the consequences are equally severe. Data incidents expose organisations to commercial risk, contractual disputes, shareholder scrutiny and long‑term reputational damage.

Recent history shows that most data failures are not caused by a single technology flaw. They stem from governance gaps: unclear ownership, limited visibility of where data actually resides and insufficient oversight of third‑party providers. Boards and executives are increasingly expected to demonstrate that these risks are understood and actively managed.

Guidance from bodies such as the Australian Institute of Company Directors and Australian Government agencies consistently frames data governance as a leadership responsibility, not something that can be fully delegated or outsourced to others in the organisation. Directors and executives are expected to understand material data risks in the same way they understand financial, safety or conduct risks. This includes knowing which datasets are critical, which laws apply to them and who is accountable when something goes wrong.

This does not require organisations to avoid global technology platforms or innovation. A more balanced and pragmatic approach is emerging across both sectors. Many organisations are deliberately keeping their most sensitive and regulated data within Australia, while allowing lower‑risk workloads to operate offshore under clear contractual and technical controls. The challenge is making these distinctions explicit and enforcing them consistently over time.

Ultimately, data sovereignty is about both trust and risk. Trust from citizens that government will safeguard their information. Trust from students and researchers that institutions will protect their work. Trust from customers, partners and investors that organisations understand and manage their data risks. Once lost, that trust is difficult and costly to rebuild.

Where to start

Strengthening data sovereignty should start with leadership asking, and answering, the right questions.
Make these a standing discussion at executive and board level:

Do we have a clear inventory of the data we hold, why we hold it and where it is physically stored?

Which Australian and foreign laws apply to our data, and do any of these create conflicts or unmanaged risk?

Do our contracts with service providers clearly restrict offshore storage or transfer unless explicitly approved?

Have we identified data that is critical to service delivery, commercial value or public trust and applied stronger controls to it?

Is there a single, clearly accountable executive responsible for oversight of data and AI use across the organisation?

If these questions cannot be answered with confidence, that is your starting point to find out more. Data sovereignty is not achieved through policy statements alone. It is built through informed leadership, deliberate choices and clear accountability.

Continue reading similar View all

Perspectives AIAzure EducationEnterprise People and workforceRisk and Issue ManagementService DeliveryStakeholder ManagementTransformation

Humans or AI, which comes first?

Case Studies Dynamics 365FabricPower PlatformPowerBI Aged CareHealthcareNon Profits and Charities PolicyRisk and Issue ManagementService DeliveryTransformation

RAAFA WA Data Governance Framework