Does your AI-built app's data have to stay in Australia?

Founders often assume an Australian app has to keep its data in Australia. On data residency, the Privacy Act is less strict than that and more demanding in a different way. It does not require Australian servers. It does make you answerable for every overseas recipient of your users' personal information, and an AI-built app usually has more of those than its founder knows about.

Data residency is not what the law asks for

Australian Privacy Principle 8 covers personal information you disclose to someone overseas. Before you disclose it, you take reasonable steps to make sure the recipient will handle it the way the Australian Privacy Principles require. The OAIC generally expects those steps to include an enforceable contract. If the recipient then mishandles the information, section 16C of the Act treats their act as yours.

Your privacy policy also has to say whether you are likely to disclose personal information overseas. Where it is practicable, it has to name the countries. Most AI-built apps get this part wrong, because the founder does not know the answer.

Check whether the Act covers you

Businesses with annual turnover of $3 million or less are generally exempt. The OAIC's small business page lists the exceptions. The one that catches app founders is the health service provider, which the Act covers at any size. The OAIC describes it as a provider of "services in relation to physical, emotional, psychological and mental health". That reaches well past clinics, into coaching and mental-health apps.

An exemption from the Act does not exempt you from Apple or Google. Their rules apply to every app in the store.

Where an AI-built app sends personal information

Tools like Lovable, Bolt and Cursor wire up a working backend in minutes. They also make decisions about where data lives that nobody reviews afterwards, so personal information can leave Australia without anyone deciding it should. Look in these places first.

The database. Hosted databases ask for a region when you create the project, and many builders accept whatever the setup screen offers. Storage alone may not count as a disclosure. Paragraph 8.14 of the APP 8 guidelines treats cloud storage as a use when the provider only stores the data under a binding contract. You also have to keep effective control of access, retrieval and deletion. Read the provider's terms before relying on that.

The AI model. If the app sends what users type, upload or say to a hosted model, that content goes to the model provider for processing. The guidelines treat handing personal information to an overseas contractor as generally a disclosure, so APP 8 applies and the provider belongs in your privacy policy. It also triggers Apple's rule below.

Analytics, crash reporting and email. Every SDK the AI tool added on your behalf is a third party with access to user data. Most of them are overseas.

What Apple and Google ask

Apple's App Review Guidelines do not ask where your servers are. They ask what you collect and who receives it.

• 5.1.1(i) requires a privacy policy, linked in App Store Connect and inside the app. It must identify what you collect, confirm that third parties such as analytics tools and SDKs give the same protection, and explain how a user requests deletion.
• 5.1.1(v) requires in-app account deletion if the app lets people create an account.
• 5.1.2(i) requires you to "clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so."

A line in the privacy policy is not explicit permission. The app has to ask the user.

The store forms have to match the app

Your App Privacy answers in App Store Connect have to match what the app actually sends. On Android, the Data safety section in Play Console asks the same questions. An AI tool that added an SDK without telling you has made both forms inaccurate, and you are the one who signed them.

What changes on 10 December 2026

New transparency rules in APP 1 start on 10 December 2026 for organisations the Act covers. They apply when a computer program makes a decision, or does something substantially and directly related to making one. The decision has to be one that could significantly affect someone's rights or interests, and the program has to use their personal information. If that describes your app, your privacy policy must set out the kinds of personal information used and the kinds of decisions involved. The OAIC's announcement and fact sheets set out the test.

Apps that use AI to approve applications, screen people, set prices or decide eligibility should check against that test before the date. The obligation is disclosure. It does not stop the app making the decision.

Checking your own app

You can answer most of this yourself in an afternoon:

• Find the region of every database and storage bucket the app uses.
• List every AI model the app calls, and what user content goes to it.
• List every SDK in the build, including ones you did not add by hand.
• Compare that list with your privacy policy and your App Privacy answers.
• Check whether the app asks before sending personal data to an AI model.

None of this is legal advice. Whether a particular arrangement is a use or a disclosure depends on its contract, and where the answer matters, a privacy lawyer is the right person to ask.

If you would rather know which gates your app faces before you submit, the free Launch Gate Check names each one with its guideline number. The Envisage Launch Gate Audit goes further. It checks your privacy labels and account deletion against the running app, sets out which parts of the Privacy Act bind you, and separates what blocks launch from what can wait. For the wider picture of taking an AI-built prototype to real users, start with from AI-built prototype to launched product.