Insights

Data residency rules just got real for SME integrators

The DTA’s Whole-of-Government Cloud Computing Policy took effect on 1 July 2026. It is mandatory. Every Commonwealth agency building or procuring digital services now has to apply the Hosting Certification Framework, which sorts cloud providers into tiers based on how they handle sovereignty and data residency (DTA, Cloud Policy announcement, 2026).

For the big end of town, this is familiar territory. AWS and Azure already hold Certified Strategic status. But for the small businesses that supply services to government, or that want to, the policy creates a practical problem that most have not thought through: where does your data actually go when you connect your systems?

The integration gap nobody is talking about

A 15-person consultancy running Xero, a CRM, and an email marketing platform is already sharing data across three vendors. Add an LLM workflow for document processing or a RAG pipeline over project files, and the data path gets longer. Each hop is a potential sovereignty breach if any of those services route processing through offshore infrastructure.

Xero stores data in Australian data centres for AU customers, but its AI features (Xero Analytics, Bank Reconciliation suggestions) process data through global infrastructure. MYOB’s REST API is local, but the third-party middleware most SMEs use to connect it to other systems often is not. The integration layer - the middleware, the automation platform, the LLM API - is where sovereignty breaks down (RobNish Tech, Xero vs MYOB integration analysis, June 2026).

What the policy actually requires

The Hosting Certification Framework has two main tiers. Certified Assured providers can hold data up to PROTECTED level. Certified Strategic providers have met additional requirements around supply chain risk and foreign ownership. For SMEs, the practical question is simpler: can you prove that every system touching government data meets the right certification tier?

Self-hosted tools like n8n solve part of this problem. An n8n instance on an Australian VPS keeps your automation logic and workflow data onshore. You control the server, the storage, and the data path. Trade-off is maintenance: you patch it, you back it up, you monitor it. A managed platform like n8n Cloud or Make runs on offshore infrastructure by default (IoTAI, Self-Hosting n8n in Australia, May 2026).

LLM integrations make the picture worse. OpenAI and Anthropic process prompts and responses on global infrastructure. Sending government data through these APIs without a data processing agreement that satisfies the HCF is a compliance gap. Local models (Llama or Qwen running on your own hardware) are the only option for workloads that touch sensitive government data. The cost has dropped. A $2,000 Mac Mini or a $500-per-month GPU VPS can run a capable model locally.

What SMEs should do now

Start with a data flow map. List every system that touches client data, trace where that data goes, and identify which systems are offshore. For most SMEs, the middleware layer and the AI layer are the gaps.

Then make one of three moves:

Use self-hosted tools where sovereignty matters. N8n on an Australian VPS, local LLMs on hardware you own, document extraction pipelines that do not send PDFs to offshore APIs.

Negotiate data processing agreements with your cloud vendors. Some will offer them. Most SMEs have never asked.

Accept that some government work requires infrastructure changes. If you want to bid on a contract that involves PROTECTED data, your existing SaaS stack may not qualify. That is a business decision, not a technical one.

This policy is not a suggestion. Agencies are already applying it to procurement. SMEs that integrate systems for government clients have until the next contract renewal to get their data paths in order.

Sources