If You Use Copilot, Gemini or ChatGPT, Does Your Data Actually Stay in Australia?

Detailed Explanation

"Where does our data actually go" is one of the first questions an Australian business asks before adopting an AI assistant, and it's usually answered with a shrug, a vague "it's in the cloud," or an assumption that a major vendor must keep Australian customers' data in Australia. None of those answers is good enough, and the real picture is more specific — and less reassuring by default — than most businesses expect.

Does it matter which country an AI tool stores your data in covers the legal side of this question: when residency actually matters under APP 8, GDPR, or sector rules, and when it doesn't. This page is the concrete companion to that one — what Microsoft Copilot, Google Gemini, and ChatGPT specifically say in their own documentation about where they process data, checked directly against each vendor rather than assumed.

Microsoft Copilot

For Microsoft 365 Copilot, the EU Data Boundary is a regional commitment for eligible EU customers. Microsoft says queries for customers outside that boundary, including Australian customers, may be processed in the US, EU or other regions. This does not describe every Microsoft AI product; Foundry has separate deployment choices discussed below.

In practical terms, an Australian business using Microsoft 365 Copilot should assume its Copilot queries can be processed offshore, most likely in the US, without a formal boundary comparable to what EU customers get. There is no equivalent "Australia Data Boundary" as of this writing.

Google Gemini (Google Workspace)

Google Workspace publishes a defined list of data regions a business can select for eligible Workspace data, which — per Google's own current documentation — covers Gemini prompts and responses both at rest and during processing. That list currently offers United States or Europe only. Australia is not an available data region selection for Google Workspace, including its Gemini features.

This means an Australian business cannot configure Google Workspace to keep Gemini processing within Australia, regardless of plan tier — the choice is between US and European processing, not a local option.

ChatGPT and the OpenAI API

OpenAI offers Australia as a selectable storage region for eligible API customers and for eligible new ChatGPT Enterprise and Edu workspaces. This is a data-residency commitment for in-scope content at rest, not a promise that every model request runs in Australia. OpenAI's current ChatGPT inference-residency list does not include Australia.

Check the scope for the particular product and plan. Storage at rest, inference, temporary processing, abuse monitoring and connected features can have different location rules. A regional-storage option is useful, but should not be described as an Australia-only processing guarantee.

Personal ChatGPT accounts should not be confused with an eligible Enterprise or Edu workspace configured for Australian data residency. Ask the workspace administrator to confirm the actual region setting where this matters.

Azure AI Foundry (for Businesses Building on Microsoft's AI Platform)

For businesses building their own tools, Microsoft Foundry is not the same product as Microsoft 365 Copilot. Foundry's deployment types include Global, US/EU/APAC Data Zone, Standard within an Azure geography, and Regional Provisioned. APAC is a multi-region zone, not an Australia-only guarantee. Geography-based and regional options may offer a narrower processing boundary for supported models, but availability varies by model, version and region. Check the deployment type and current region-availability table before making a location commitment.

What This Means in Practice

None of the named end-user assistants should be assumed to process all data in Australia by default. Some enterprise or developer options offer Australian storage or narrower deployment boundaries. The practical checks are:

• For most day-to-day business use — drafting, summarising, general assistance — offshore processing by a mainstream vendor is a manageable, disclosed risk under APP 8's reasonable-steps requirement, not an automatic disqualifier.
• For information where processing location genuinely matters, such as data subject to a contract or sector-specific restriction, distinguish Australian storage from Australian processing. An OpenAI regional-storage option alone may not meet an Australian-only processing requirement. A supported Foundry regional deployment or a private deployment may be worth assessing separately.
• Confirm before relying on any of this for a specific compliance commitment. Vendor data-residency offerings change — Google, Microsoft and OpenAI have all updated these terms multiple times in recent years — so treat the specifics here as current as of the dates in this page's sources, and re-verify against each vendor's own documentation before making a compliance representation to a customer or regulator based on it.

Things to Consider

• This is a different question from data training. Whether a vendor trains its models on your business's data is a separate commitment from where that data is physically processed — check both, not just one, when evaluating a vendor. See is it safe to put company data into AI tools for the training and retention side of this.
• A DPA should name the specific mechanism, not just assert compliance. When evaluating an AI vendor's data processing agreement, check that it names the actual processing regions and any regional commitment specifically, rather than accepting a general "we take privacy seriously" statement.
• Plan tier matters. Regional processing and residency options are frequently limited to specific business or enterprise plan tiers across all three vendors — confirm the option is actually included in the plan the business is on or considering, not just that the vendor offers it somewhere in its product range.
• Revisit this periodically, not just at initial adoption. All three vendors have changed their data-region offerings within the past two years; a residency check done during initial vendor selection can go stale, particularly given this cluster's shorter six-month review cycle.

Common Mistakes

• Assuming a major vendor automatically means Australian data stays in Australia. None of the three defaults to Australia-only processing, and assuming otherwise is one of the more common and consequential mistakes a business can make when representing its AI vendor arrangements to a customer or regulator.
• Treating Australian data residency as an inference guarantee. Eligible ChatGPT Enterprise/Edu and API configurations can offer Australian storage, but the scope and processing boundary must be checked separately.
• Assuming all three vendors behave the same way. Microsoft, Google and OpenAI each structure their regional commitments differently — a residency check done for one vendor doesn't transfer to another, even within the same business.
• Not distinguishing personal, enterprise and developer products. ChatGPT, the OpenAI API, Microsoft 365 Copilot and Microsoft Foundry have different regional controls; check the product actually in use.