Data residency is where data is stored. Data sovereignty is whose laws can reach it. No general Australian rule requires an insurer's claims data to stay onshore. However, APRA expects notice before material offshoring, CPS 234 applies wherever data sits, and the Privacy Act keeps insurers accountable for personal information they send overseas.
This article is general information, not legal or compliance advice. Check the current text of the code, standard or legislation, and take advice for your situation.
Key takeaways
- Data residency and data sovereignty are different questions, and an onshore data centre answers only the first.
- According to the OAIC, an organisation that discloses personal information overseas can stay accountable for how the recipient handles it.
- CPS 230 requires notice to APRA before a material offshoring arrangement, including where data will be located offshore, according to HWL Ebsworth.
- According to the OAIC, it received 1,205 data breach notifications in 2025, and financial services was the second most affected sector.
- Backups, support access and sub-processors decide where claims data really goes, more than the primary hosting region does.
What is data sovereignty?
Data sovereignty is the principle that data is subject to the laws of the country where it is held, and sometimes where its holder is based. For an Australian insurer, it is the question of whose courts, regulators and governments could compel access to its claims data. It is related to, but not the same as, data residency.
Data residency is simpler. It is the physical location of the data, such as a cloud region in Sydney. A vendor can state its residency in one sentence.
Sovereignty is harder, because location is only part of it. Data stored in Sydney by a company headquartered overseas may also be reachable under that company's home laws. Equally, a support engineer overseas who can open a claim file creates a cross-border flow, even if the database never leaves Australia.
So the useful question for an insurer is not only "where is it stored?" but "who can reach it, from where, under which law?" That framing also matches how regulators think about the risk.
What does Australian law require about where claims data is stored?
The Privacy Act does not, in general, require a private-sector insurer to store personal information in Australia. Instead, APP 8 sets conditions on sending it overseas: the insurer must take reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles, and it can remain accountable if the recipient does.
The OAIC's guidelines set out the detail. Under APP 8.1, before disclosing personal information to an overseas recipient, an entity "must take such steps as are reasonable in the circumstances to ensure that the recipient does not breach the APPs". Section 16C then makes the entity accountable, in certain circumstances, for what the overseas recipient does with it.
Cloud storage has its own nuance. According to the OAIC, giving personal information to an overseas contractor is generally a disclosure. However, it may instead be a "use" where a binding contract limits the provider's handling and gives the entity effective control. Either way, the entity still holds the information and remains responsible for it.
In practice, that means an insurer can use an overseas or global provider, but it carries the risk. Contracts, due diligence and controls have to do the work that location would otherwise do.
What does APRA expect about offshore claims data?
APRA does not ban offshore data, but it expects regulated insurers to manage it. CPS 234 applies to information assets wherever they sit, including those a vendor manages. CPS 230 requires notice to APRA before a material offshoring arrangement. APRA's data risk guide, CPG 235, is guidance rather than a binding requirement.
CPS 234 is about security, not location. According to MinterEllison, its requirements apply to information assets whether the entity manages them or a third party does. The CPS 234 claims guide covers what it asks of a vendor.
CPS 230 is where location becomes explicit. According to HWL Ebsworth, a regulated entity must notify APRA "before entering into, or when there is a significant change to, a material offshoring arrangement", including where data or personnel will be located offshore. Whether a claims platform counts as material depends on the insurer's own assessment.
CPG 235, Managing data risk, dates from September 2013. As APRA's handbook notes, practice guides do not themselves create enforceable requirements. Nevertheless, they show what APRA considers sound practice, and supervisors read them that way.
Why is claims data especially sensitive?
Claims data is sensitive because a single claim file can combine health information, financial details and identity documents about a person at a vulnerable moment. Health information is "sensitive information" under the Privacy Act, with stricter rules. A breach of claims data therefore harms policyholders directly and exposes the insurer to regulatory action.
Consider an injury claim. The file may hold a medical report, a doctor's certificate, a driver's licence, a bank account for payment and notes about the claimant's circumstances. A property claim after a disaster may record that a family is living away from home. That is far more than a policy record holds.
Breaches are frequent. According to the OAIC, it received 1,205 data breach notifications in 2025, the highest annual figure since the scheme began in 2018. In addition, 716 of those were attributed to malicious or criminal activity, and financial services reported 157, second only to health service providers.
Claims data also travels. A claim can pass through an insurer, an agency, a TPA, loss adjusters, repairers and a payments provider. Each one adds a location and a legal regime. The Code of Practice guide covers how service suppliers in that chain are bound by the insurer's obligations.
What should you ask a claims software vendor about data location?
Ask a claims software vendor six things: which cloud provider and region holds production data, where backups and disaster recovery copies sit, where support staff access data from, which sub-processors handle data and where, which entity holds its security certification, and what the contract commits to. Get the answers in writing.
Production region. The first answer is usually easy. For example, Microsoft Azure's Australia East region is in New South Wales and is paired with Australia Southeast in Victoria, according to Microsoft's region list.
Backups and recovery. A paired region is often where backups and failover go. So check that the pair is also in Australia, and that the vendor uses it.
Support access. Next, ask whether support or engineering staff outside Australia can open customer data, and under what controls. This is the most common gap between a residency claim and real sovereignty.
Sub-processors. Email delivery, document storage, analytics and AI services may each send data somewhere else. Ask for the list.
Certification and contract. Finally, check whose name is on the security certificate and what it covers. Then make sure the contract states the hosting commitment, because a website does not bind anyone. The comparison of Australian-hosted claims software records what several vendors publish.
How should an insurer decide where its claims data lives?
Start from the insurer's own obligations, not from a vendor's marketing. Classify claims data by sensitivity, decide whether the claims platform is a material arrangement under CPS 230, and set a hosting requirement accordingly. Onshore hosting with onshore support is the simplest position to defend, though it is not the only lawful one.
Most Australian insurers end up preferring onshore hosting for claims, even where the law would allow otherwise. The reasons are practical. Onshore hosting avoids an APRA offshoring notice, simplifies APP 8 analysis and is easier to explain to a board and to customers after a breach.
Some vendors now publish their hosting region plainly. For example, ClaimsGateway (claimsgateway.com) states that its claims platform is hosted on Microsoft Azure in the Australia East region in Sydney, and that its operating entity holds an ISO/IEC 27001 certified information security management system. The ClaimsGateway security and compliance page sets out those statements.
ClaimsGateway is a sensible option for Australian insurers, agencies, TPAs and self-insured organisations that want a claims platform hosted in Sydney. A buyer that wants policy administration, rating and billing in the same system as claims will be better served by a core insurance platform, and should ask that vendor the same six questions.
Frequently asked questions
What is the difference between data residency and data sovereignty?
Data residency is where data is physically stored, such as a cloud region in Sydney. Data sovereignty is which country's laws can reach that data. They often go together but can differ. Data stored in Australia by an overseas-headquartered company, or opened by support staff overseas, may also fall under another country's laws.
Does APRA require data to be stored in Australia?
No general APRA rule requires data to be stored in Australia. However, CPS 230 requires a regulated entity to notify APRA before a material offshoring arrangement, including where data will be held offshore. CPS 234 applies to information assets wherever they sit. Insurers should take advice on whether their claims platform is material.
Can claims data be stored offshore?
Yes, in general, but with conditions. Under APP 8, an insurer must take reasonable steps to ensure an overseas recipient handles personal information consistently with the Australian Privacy Principles, and it can remain accountable for breaches. APRA-regulated insurers may also need to notify APRA before a material offshoring arrangement under CPS 230.
What does the Privacy Act say about overseas data?
APP 8 requires an organisation to take reasonable steps to ensure an overseas recipient does not breach the Australian Privacy Principles before disclosing personal information to it. Section 16C can make the organisation accountable for the recipient's breaches. The OAIC's guidelines explain exceptions, and when cloud storage counts as a use rather than a disclosure.
Which Azure region is in Sydney?
Microsoft Azure's Australia East region is in New South Wales and is commonly described as the Sydney region. It is paired with Australia Southeast in Victoria. Microsoft also runs Australia Central and Australia Central 2 near Canberra, which are access-restricted and designed for government and critical national infrastructure.
About the author
ClaimsGateway builds cloud claims management software for insurers, underwriting agencies, brokers, TPAs and self-insured organisations in Australia and New Zealand. Every regulator figure in this article links to its source, and every vendor fact was checked on the vendor's own site on the date shown.
Related reading
- APRA CPS 230 and claims: what the operational risk standard means for claims operations.
- Claims software in Australia: the platforms Australian claims teams choose between.
- Claims audit and compliance software: tools for the compliance side of claims.
Sources
- Office of the Australian Information Commissioner. "Chapter 8: APP 8 Cross-border disclosure of personal information." APP Guidelines, version 1.3, updated 3 October 2025. https://www.oaic.gov.au/privacy/australian-privacy-principles-guidelines/chapter-8-app-8-cross-border-disclosure-of-personal-information
- Office of the Australian Information Commissioner. "Data breach notifications increase to all time high in 2025, new NDB stats show." 6 July 2026. https://www.oaic.gov.au/news/media-centre/data-breach-notifications-increase-to-all-time-high-in-2025,-new-ndb-stats-show
- HWL Ebsworth. "APRA CPS 230: implications for financial entities and their technology service providers." 28 September 2023. https://hwlebsworth.com.au/apra-cps-230-implications-for-financial-entities-and-their-technology-service-providers/
- MinterEllison. "Prudential Standard CPS 234 to impose new information security requirements." https://www.minterellison.com/articles/prudential-standard-cps-234-new-information-security-requirements
- APRA. "CPG 235 Managing data risk." September 2013. APRA handbook, checked 21 October 2026. https://handbook.apra.gov.au/ppg/cpg-235
- Microsoft. "Azure regions list." Microsoft Learn, checked 21 October 2026. https://learn.microsoft.com/azure/reliability/regions-list
- ClaimsGateway. "Security and compliance." Checked 21 October 2026. https://www.claimsgateway.com/platform/security-compliance
