The six-field residency review
| Field | Buyer question | Required evidence |
|---|---|---|
| Storage | Where are prompts, outputs, files, logs and backups stored? | Product, region, feature and retention record. |
| Processing | Where is inference and feature processing performed? | Architecture for the purchased route. |
| Access | Can provider, support, safety or incident personnel access content from elsewhere? | Purpose, trigger, location, authorization and logs. |
| Subprocessors | Which entities receive which categories? | Current list, service, location and change notice. |
| Overseas disclosure | Does the route engage APP 8 or another transfer question? | Data flow and assigned legal assessment. |
| Professional duty | Does the workflow preserve confidentiality, competence and supervision? | Approved use, reviewer and escalation path. |
Start with OAIC due diligence
The OAIC guidance on commercially available AI products, checked September 3, 2026, is the primary operational starting point. It asks organisations to understand the product, assess privacy risk and use appropriate governance before deploying it. The companion guidance on developing and training generative AI addresses a different activity. A buyer using a service should not automatically describe itself as training the provider's model.
Document the purpose, necessity, personal-information categories, affected people, transparency, security, retention and human review. A privacy impact assessment can organise the evidence; it does not replace product-specific facts.
Keep the overseas-disclosure question separate
The Privacy Act 1988 consolidation, current to June 10, 2025 and checked September 3, 2026, contains the Australian Privacy Principles, including APP 8 on cross-border disclosure. Whether a route involves disclosure and what obligations follow depends on the entities, control, data flow and exceptions. This page does not make that legal conclusion.
Ask where each copy goes and which entity can use it. A service may store customer content in an Australian region while global support, abuse monitoring, connectors or customer-configured exports create separate access or transfer paths. Conversely, a global provider name alone does not prove that every category leaves Australia.
Add the professional-duty file
The Law Society of New South Wales guide, updated January 2026, and the Law Council of Australia AI portal, both checked September 3, 2026, are professional sources. Use the guidance applicable to the solicitor and jurisdiction. Keep client confidentiality, competence, supervision, accuracy and disclosure questions distinct from privacy-law analysis.
An approved route card should tell practitioners which account to use, permitted data, prohibited features, required reviewer, final system of record and stop condition. “Australian hosted” is not a route card.
Verify the exact product surface
OpenAI's business-data page describes business-product defaults. Its Gilbert + Tobin story shows one Australian firm's deployment narrative. Neither source proves the contract, region, configuration or outcome for another buyer. Preserve the order form, data-processing terms, administrator settings and architecture for the service actually purchased.
Apply the same rule to every vendor: consumer chat, managed workspace, API, cloud marketplace and embedded legal product are separate routes. Do not import an enterprise residency statement into a personal account or connector.
Run a non-sensitive route test
- Create a canary project in the intended region and account.
- Enable only the features the workflow requires.
- Capture observable logs, storage, access roles and subprocessors.
- Test export, deletion, support and incident escalation.
- Record provider-side facts that remain outside customer visibility as Unknown.
- Obtain privacy and professional review for the named workflow, not the vendor generally.
Close with a narrow decision
Approve, restrict or reject one workflow, account, region, feature set and data class. Name the owner and review trigger. This creates a credible buyer record without pretending that one residency label resolves privacy, professional responsibility or privilege.
FAQ
Does Australian data residency mean the AI service is privacy compliant?
No. Residency is one fact. The organisation still needs the purpose, data flow, access, retention, subprocessors, overseas-disclosure analysis and controls. Official source · checked 2026-09-03
Is storage location the same as processing location?
No. Record storage, inference, support access, safety review and feature-specific processing separately. Official source · checked 2026-09-03
What should an Australian law firm verify before using generative AI?
Verify the exact product and account, permitted data, access and transfer path, retention, supervision, output review and the professional guidance applicable to the practitioner. Official source · checked 2026-09-03
Sources checked
- Commercially available AI products guidance, checked 2026-09-03.
- Developing and training generative AI guidance, checked 2026-09-03.
- Privacy Act 1988, current consolidation, checked 2026-09-03.
- Artificial intelligence and the legal profession, checked 2026-09-03.
- A solicitor’s guide to responsible use of AI, Jan. 2026, checked 2026-09-03.
- Business data controls, checked 2026-09-03.
- Gilbert + Tobin customer story, checked 2026-09-03.
Operational information, not legal advice. Verify current terms, account configuration and applicable professional duties before use.