By Michael Pattison, Lawyer & Founder, ContractProbe

When contract data goes to an AI review tool, "data sovereignty" covers more than where the vendor is headquartered. It covers where the contract is uploaded, where the model actually runs, where prompts and outputs are stored, where logs and backups sit, and where support staff can access your data. For Australian legal, procurement, and commercial teams, three questions decide most of the risk: is data processed exclusively in Australia, where is the supplier (and its subprocessors) actually located, and has the tool been built to recognise Australia-specific statutes..

Is your contract data processed exclusively in Australia?

"Processing" should be read broadly. It includes where the contract is uploaded, where model inference happens, where prompts and outputs are stored (even temporarily), where logs are retained, where backups are held, and where supplier support personnel can access systems. Publicly reported Australian data incidents show that oversight and incident response get harder when key systems, subprocessors, or operational teams sit offshore — so understanding the full data flow, not just the marketing claim of "Australian company," is what actually matters for risk assessment.

Benefits of data being processed exclusively in Australia:

• Increased ability for customers to monitor how data is handled and protected.
• Assists compliance with Australian privacy laws and internal governance requirements.
• Reduces exposure to cross-border transfer risk, including accountability under section 16C of the Privacy Act.

What obligations does APP 8 create when contract data includes personal information?

Where contracts containing personal information are disclosed to a supplier outside Australia, Australian Privacy Principle 8 (APP 8) generally requires the disclosing organisation to take reasonable steps to ensure the overseas recipient handles that information consistently with the Australian Privacy Principles, unless an exception applies. In practice, APP 8 due diligence covers both the privacy laws that govern the place where the data is processed and the supplier's actual data handling practices — any gaps typically need to be closed through contractual provisions covering security, audit rights, retention, and breach notification.

Section 16C of the Privacy Act adds a further layer: it can make an Australian organisation accountable for misuse or mishandling of personal information by an overseas recipient it disclosed data to. Managing this exposure means doing due diligence on the recipient's practices up front and making sure the contract clearly allocates responsibility and provides enforceable protections.

Due diligence questions to ask before sending contract data offshore:

Due diligence questions to ask before sending contract data offshore:

• Where is any personal information in the contract stored, processed, and backed up (including disaster recovery)?
• Where does model inference occur?
• Are outputs retained, and if so, for how long?
• What logs are collected, and do they contain customer content or sensitive metadata?
• Who can access systems (including support/admin access), from where, and under what controls?
• What subprocessors are used, and where are they located?
• Is customer content used to train models (by default, opt-in, or opt-out), and what controls prevent leakage?
• What are the supplier's incident response SLAs (time to notify, time to escalate, escalation contacts)?

Where is your AI contract review supplier (or its critical subprocessors) located?

Even when data is processed in Australia on paper, supplier location and corporate structure can materially affect how well-protected that data actually is. Where a supplier's operations or key subprocessors sit mainly offshore, incident response, time-zone coverage, and crisis prioritisation tend to slow down.

Prompt notification matters because Part IIIC of the Privacy Act requires an Australian company that experiences an eligible data breach to notify affected individuals and the Office of the Australian Information Commissioner (OAIC). If a supplier is holding your contract data, you need to be informed of incidents quickly enough to meet that obligation yourself.

There's also a compelled-disclosure risk to weigh: laws of a foreign country can require an overseas company (directly, or through subsidiaries holding data in Australia) to disclose that information on request from a foreign government. The US CLOUD Act and its enabling legislation in Australia is the most commonly cited example.

Due diligence questions on supplier location:

• What is the supplier's corporate structure (parent entities and key group companies)?
• Are there contractual commitments to notify disclosure requests (where lawful) and minimise disclosures?
• Can the customer require onshore-only access for sensitive information?
• Which jurisdictions can compel the supplier and its critical subprocessors (including cloud providers) to hand over customer information?

Benefits of the supplier being located in Australia:

• Better familiarity with Australian legal requirements and client expectations, plus support during Australian business hours during a crisis.
• More likely to run policies and controls aligned with Australian privacy and security expectations.
• Reduced exposure to foreign legal compulsion risk (subject to the supplier's own subprocessor choices).

Has the AI contract review tool been designed to cover Australia-specific statutes?

Many generative AI tools are trained predominantly on data from outside Australia, which means they may not be well suited to the Australian legal context. Australian organisations operate under statutes that in some cases are unique to Australia, or that treat familiar issues differently — a model that hasn't been trained to recognise these differences is more likely to produce incomplete or incorrect output.

A concrete example: Australian Privacy Principle 11.1 requires an organisation to take reasonable steps to protect personal information from misuse, interference, and loss. When information is disclosed to a third party, that duty can extend to taking steps at the time of disclosure to ensure the third party will treat the information appropriately afterwards. A contract review tool checking a disclosure clause should be able to identify this and recommend measures — stronger security obligations, audit/assurance rights, breach notification, and appropriate indemnities. A tool that isn't attuned to Australian requirements can easily miss this extension of responsibility.

In practice, contracts drafted by overseas suppliers often lack robust language protecting disclosed personal information. A typical gap-filling clause looks like this:

Upon the occurrence of a Security Incident, the Supplier must: (a) promptly notify the Customer of the incident and provide full details on an ongoing basis as they become known; (b) promptly take all actions necessary to minimise the incident's adverse consequences on the Customer; (c) promptly take all actions necessary to prevent reoccurrence of that Security Incident or similar incidents; and (d) provide the Customer with ongoing details of the steps taken under (b) and (c). "Security Incident" means any actual or suspected incident resulting in, or that may result in, misuse, interference, loss, unauthorised access, unauthorised modification, or unauthorised disclosure of data provided by the Customer or generated in the course of providing services, including any incident constituting an eligible data breach under Part IIIC of the Privacy Act 1988 (Cth).

Benefits of a tool designed around Australian statutes:

• Higher accuracy from being trained on Australian-sourced data and drafting patterns.
• More likely to catch issues specific to Australian law and procurement expectations — see how this plays out in SaaS agreement clause review, a closely related procurement context.