Zoho • 11 MIN READ
Is Zoho data stored in Australia? Privacy Act and data residency explained
Yes, if your account is on Zoho's Australian data centre. Here's how to check, what the Privacy Act actually requires, and what to have ready before a bigger client asks.
Practical guides on Zoho CRM, websites and growth for Australian businesses, written by the Vixo team in Forestville, NSW. See related services →
The short answer
Yes, it can be. Zoho opened its Australian data centres in 2019, with Sydney as the primary site and Melbourne as the secondary for disaster recovery. Accounts registered on the Australian data centre are stored there and aren't shared with Zoho's other regions. Zoho lists certifications including ISO 27001 and SOC 2 Type II for both sites.
The catch is that your account has to actually be on the Australian data centre. Zoho assigns it at sign-up based on the country you choose, which is pre-filled from your IP address. If someone in your business signed up years ago while travelling, or picked the wrong country, you could be on the US data centre without realising.
How to check where your data lives
A two-minute check
Look at the address bar
If you log in at accounts.zoho.com.au and your apps run on .com.au addresses, such as crm.zoho.com.au, you're on the Australian data centre.
If it says zoho.com
Your account is on the US data centre. Moving regions isn't a self-service switch, so talk to Zoho support or your partner before you build much more on top of it.
Check every app
In a multi-app setup, each app should follow your organisation's data centre. It's still worth confirming.
What the Privacy Act actually asks of you
Australian law doesn't say that all data has to stay onshore. What the Australian Privacy Principles (APPs) in the Privacy Act do require is this:
The principles that come up most
APP 8: cross-border disclosure
Before you disclose personal information to an overseas recipient, you need to take reasonable steps to make sure they'll handle it in line with the APPs. In many cases, you stay accountable if they don't.
APP 11: security
Take reasonable steps to protect personal information from misuse, loss and unauthorised access, and destroy or de-identify it once you no longer need it.
APP 1: transparency
Your privacy policy should say whether you're likely to disclose information overseas and, where practical, to which countries.
Keeping data in Sydney and Melbourne makes the cross-border question much simpler, but it doesn't make it disappear. Vendors' support teams can be located overseas, so read Zoho's data processing terms to understand how support access works and is controlled. Then make sure your privacy policy accurately describes what you do.
Data residency answers 'where is it stored'. Your clients will also ask 'who can see it'. Have an answer for both.
Small businesses and the exemption
Many businesses with annual turnover of $3 million or less are currently exempt from most of the Privacy Act. There are exceptions, including health service providers and businesses that trade in personal information. Removing the exemption has been part of the government's privacy reform agenda, and since June 2025 individuals have been able to sue over serious invasions of privacy under a new statutory tort, whether or not the business is exempt. Even if you're exempt today, larger clients and government buyers will ask how you handle data, so it's better to have the answer ready. Check the current position with your adviser, because this area is changing.
Settings worth turning on in Zoho
Quick wins
Two-factor authentication
Enforce it for every user at the organisation level, not just for admins.
Roles and profiles
Make sure staff only see the records they need, and restrict sensitive fields.
Audit logs and login history
Review them occasionally, not just after something has gone wrong.
IP restrictions
Consider them for admin accounts if your team works from fixed locations.
Retention rules
Delete or anonymise old leads and contacts you no longer need. Data you don't hold can't leak.
Answering the client security questionnaire
Bigger clients will send a security questionnaire before they sign. Keep a one-page summary ready: where your data is stored (Sydney, with Melbourne backup), Zoho's certifications, how access is controlled in your account, a link to your privacy policy, and who to contact if there's a breach. Ten minutes of prep now saves a week of back-and-forth when the deal is on the line.
