Cloud Services Agreement Lawyers Adelaide: Data Location, Security, Lock-in and Exit
Cloud services agreements in South Australia
A cloud agreement accepted with a click still decides where the business’s data sits and what happens when it wants to leave. Talon Legal reviews and negotiates cloud infrastructure, platform and hosted service agreements for Adelaide businesses, and drafts the terms Adelaide cloud providers sell on. Book a same-day free 30-minute consultation or call (08) 7094 2021.
Cloud services agreement key facts
| Issue | Position in South Australia |
|---|---|
| What this page covers | Infrastructure as a service (IaaS), platform as a service (PaaS), cloud storage and backup. Software as a service is covered in the SaaS agreements guide. |
| Online acceptance | A transaction is not invalid because it took place wholly or partly by electronic communications (Electronic Communications Act 2000 (SA) section 7(1)). |
| Offshore storage | Disclosing personal information to an overseas recipient requires reasonable steps so the recipient does not breach the APPs (APP 8.1), and the Australian entity can be liable for the recipient's acts (section 16C). |
| Storage-only arrangements | The Information Commissioner's APP guidelines say an overseas cloud provider engaged only to store data may be a use rather than a disclosure, where the contract confines it and leaves the customer in effective control. |
| Overseas providers | The Privacy Act extends to acts outside Australia by an organisation that carries on business in Australia (section 5B(1A) and (3)). |
| Security | A customer covered by the Privacy Act must take reasonable steps to protect personal information it holds (APP 11.1). Overreliance on third party providers counted against the company in the first civil penalty case ([52]). |
| Consumer customers | A business paying $100,000 or less is a consumer (ACL section 3 and regulation 77A). Goods include computer software (section 2). |
| Contracting out | A term excluding the consumer guarantees is void (section 64), and a foreign governing law clause does not displace them (section 67; Valve v ACCC at [103]). |
| Price and term changes | In a standard form small business contract, a right for the provider alone to vary the terms, the services or the price can be unfair (section 25(d), (f) and (g)). |
| Maximum penalty (unfair terms) | Body corporate: the greatest of $100,000,000, three times the benefit, or 30% of adjusted turnover. Anyone else: $2,500,000 (section 224). |
| Subscription exit | From 1 July 2027, consumer and small business subscriptions must have an easy way to end them, online where the customer signed up online (new ACL section 48F). |
| First step | Same-day free 30-minute consultation. Call (08) 7094 2021. |
Need a cloud services agreement lawyer in Adelaide?
Our cloud services agreement lawyers in Adelaide act for businesses moving systems and data to the cloud, and for the Adelaide providers and resellers that supply cloud services. A cloud services agreement governs infrastructure, platforms or storage supplied on demand and paid for by use or subscription. The Australian Consumer Law (ACL) in the Competition and Consumer Act 2010 (Cth) and the Privacy Act 1988 (Cth) override parts of it. This page states the law current to 24 October 2026.
This guide is part of our IT outsourcing, cloud and hosting practice. Related guides cover web hosting and data centre agreements, IT offshoring agreements, software licences and SaaS agreements and data protection and privacy.
For security schedules and breach notice in cloud contracts, see our guide to data security clauses. For AI services bought from a cloud provider, see AI contracts and data licensing.
Free Consultation. Send us the provider’s terms before you migrate. Book a same-day free 30-minute consultation or call (08) 7094 2021.
On this page
- What does a cloud services agreement need to cover?
- Is storing data with an overseas cloud provider a disclosure?
- Who is responsible for security in the cloud?
- Do the consumer guarantees apply to cloud services?
- Can a cloud provider change the terms or the price?
- What service levels should a cloud agreement have?
- How do you avoid lock-in and get your data back?
- Do critical infrastructure laws affect cloud providers?
- Is a click-through cloud agreement binding?
- How similar matters tend to play out
- How we act on cloud agreements
- Case law
- Frequently asked questions
What does a cloud services agreement need to cover?
The service, the data and the exit. A cloud agreement should say which services are supplied, in which regions they run, how availability is measured and what the customer gets when it is missed. It should also say how prices change, when the provider can suspend the account, what the provider may do with the customer’s data, and how the customer gets that data out.
Cloud security is shared, and the agreement should say where the line falls. In an infrastructure service the provider usually secures the physical facilities and the underlying platform, while the customer configures and secures what it builds on top. Many incidents happen in the customer’s half, so a business should know before it migrates which controls it is responsible for.
Global providers rarely negotiate with small customers, but resellers, local providers and larger contracts often do. Even where the terms cannot be changed, a cloud services agreement lawyer can tell the business which risks it must manage itself, by keeping its own backups, choosing Australian regions or limiting what data it moves.
Is storing data with an overseas cloud provider a disclosure?
Often, but not always. Before an APP entity discloses personal information to an overseas recipient, it must take such steps as are reasonable in the circumstances so that the recipient does not breach the APPs (APP 8.1). If the overseas recipient then does something that would breach the APPs, the act is treated as a breach by the Australian entity (section 16C).
The Information Commissioner’s APP guidelines take a narrower view of storage. Giving personal information to an overseas contractor is a disclosure in most cases. But a cloud provider engaged only to store the information and give the customer access to it may be a “use” instead. That requires a binding contract confining the provider to those purposes, the same obligations on its subcontractors, and effective control for the customer over access, changes, retrieval and security.
The practical step for most businesses is to choose Australian regions where they are available, and to read the provider’s terms on support access and sub-processors. Support staff overseas who can see the data may turn a storage arrangement into a disclosure.
An overseas provider can also be bound by the Privacy Act itself. The Act extends to acts done outside Australia by an organisation with an Australian link, which includes an organisation that carries on business in Australia (section 5B(1A) and (3)). That does not remove the customer’s own obligations.
The exceptions in APP 8.2 matter too. APP 8.1 does not apply where the entity reasonably believes the recipient is bound by a substantially similar law or binding scheme that individuals can enforce (APP 8.2(a)). Nor does it apply where individuals are expressly told that the protection will not apply and then consent (APP 8.2(b)).
Who is responsible for security in the cloud?
The customer, for the personal information it holds, whatever the provider promises. An entity holds personal information if it has possession or control of a record containing it (Privacy Act section 6(1)). It must take reasonable steps to protect that information from misuse, interference and loss, and from unauthorised access, modification or disclosure (APP 11.1). Those steps include technical and organisational measures (APP 11.3).
The first civil penalty case shows the cost of leaving it to providers. In Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224, one reason the company had not taken reasonable steps was its overreliance on third party service providers ([52]). After a cyberattack, it relied on an external provider’s assessment that monitored only 3 of at least 127 affected computers ([77]). Knowing the assessment was limited, it could not reasonably rely on it alone ([78]). The penalties totalled $5,800,000.
A cloud agreement should give the customer what it needs to meet its own breach obligations. A suspected eligible data breach must be assessed within 30 days (section 26WH), and an eligible one notified to the Commissioner and affected individuals as soon as practicable (sections 26WK and 26WL). That means prompt incident notice from the provider, access to the relevant logs and cooperation with the assessment.
Do the consumer guarantees apply to cloud services?
Where the customer is a consumer, yes. A business is a consumer if the price was $100,000 or less, or the goods or services are of a kind ordinarily acquired for personal, domestic or household use (ACL section 3 and regulation 77A). Services must then be rendered with due care and skill and be reasonably fit for a purpose the customer makes known (sections 60 and 61).
Goods include computer software (section 2). In ACCC v Valve Corporation (No 3) [2016] FCA 196, Edelman J held that a supplier of downloaded games supplied goods, noting that the definition was extended in 2011 to include computer software ([137]). He also held that not everything the supplier provided was a good, but the core of its supply was software ([157]). Infrastructure and platform services are more naturally services. Where software is also supplied, the guarantee of acceptable quality for goods may apply as well (section 54).
The guarantees cannot be contracted out of. A term that purports to exclude, restrict or modify them is void (section 64). For services not ordinarily acquired for personal use, a provider may limit its liability to supplying the services again or paying the cost of that, unless the customer shows reliance on the limit is not fair or reasonable (section 64A(2) and (3)).
Choosing foreign law does not avoid them. The consumer guarantees apply despite a term that substitutes the law of another country (section 67). In Valve Corporation v ACCC [2017] FCAFC 224, the Full Court rejected the argument that the guarantees did not apply because the contract’s proper law was foreign ([103]). It said the evident purpose of section 64 is that parties cannot contract out of them ([107]).
Can a cloud provider change the terms or the price?
Only as the contract allows, and in a standard form consumer or small business contract a one-sided variation right may be unfair. The statutory examples of terms that may be unfair include a right for one party alone to vary the terms, to vary the upfront price without the other party being able to terminate, or to vary the characteristics of the services (ACL section 25(d), (f) and (g)).
A term that sets the upfront price is excluded from the unfair terms test (section 26(1)(b)). A term allowing the provider to change that price later is not. In ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224, a services supplier’s right to raise prices for any reason, with no matching right for the customer to terminate, created a significant imbalance ([56]). Its automatic renewal clause was also declared unfair ([56]).
In ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928, a supplier of office equipment, software and ongoing support conceded that terms including unilateral variation, automatic renewal and liability limitation were unfair ([1] to [3] and orders). Since 9 November 2023, making a standard form contract containing an unfair term the provider proposed, or relying on one, has been a contravention (sections 23(2A) and (2C)). The maximum penalty for a body corporate is the greatest of $100,000,000, three times the benefit, or 30% of adjusted turnover (section 224).
A small business contract is one where at least one party employs fewer than 100 persons or had turnover under $10,000,000 in its last income year (section 23(4)). Many Adelaide businesses that buy cloud services qualify.
What service levels should a cloud agreement have?
Ones that are measurable and match how much the business depends on the service. The agreement should define availability, the period it is measured over, what counts as downtime, and the maintenance windows and events excluded. Standard cloud terms commonly offer service credits as the sole remedy, often only on a claim made within a short period.
Service credits are fixed sums triggered by a failure, so the penalties doctrine is the relevant check. In Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28, Kiefel J, with French CJ agreeing, asked whether a sum payable on default is out of all proportion to the interests the provision protects ([29]). The appellants did not establish that the bank’s late payment fee was a penalty ([69]). Credits rarely fail that test. The real question for a customer is usually whether they are worth anything.
Exclusions and caps are read for what they say. Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82, an appeal from South Australia, held that a limitation clause is construed according to its natural and ordinary meaning, read in light of the contract as a whole. Where appropriate, an ambiguous clause is construed against the party relying on it ([16]). A business that needs more than credits should negotiate a right to terminate for repeated failure.
How do you avoid lock-in and get your data back?
By agreeing the exit before entering. The agreement should give the customer the right to export its data in a usable, documented format, a period after termination during which the data stays available, help with migration at a stated price, and deletion once the customer confirms the transfer.
Deletion matters to both sides. An APP entity that no longer needs personal information for any permitted purpose, and is not required by law to keep it, must take reasonable steps to destroy or de-identify it (APP 11.2). A provider that keeps a former customer’s data indefinitely carries risk it gains nothing from.
Termination terms can be unfair too. A term letting only one party terminate, or penalising only one party for terminating, is a statutory example of a term that may be unfair (section 25(b) and (c)). From 1 July 2027, a supplier of a subscription contract to a consumer, or to a small business on a standard form contract, must provide a way to end it that is easy to find and straightforward. Where the customer signed up online, one way must be online (new ACL section 48F, inserted by the Unfair Trading Practices Act 2026).
Do critical infrastructure laws affect cloud providers?
Some of them. Under the Security of Critical Infrastructure Act 2018 (Cth), a data storage or processing service includes a commercial service that lets end users store or back up data, and a commercial data processing service (section 5). Business critical data includes personal information relating to at least 20,000 individuals (section 5).
A provider’s asset becomes a critical data storage or processing asset where it is used wholly or primarily for a service relating to business critical data. The end user must be a Commonwealth, State or Territory body, or the responsible entity for a critical infrastructure asset, and the provider must know it (section 12F(1) and (2)). A responsible entity that becomes aware a provider supplies it with such a service must take reasonable steps to tell the provider as soon as practicable (section 12F(3)).
A cloud provider selling to government or critical infrastructure customers should expect contract terms that pass those obligations through. A customer in that position should tell its provider, because the duty to do so is its own.
Is a click-through cloud agreement binding?
Usually. Under section 7(1) of the Electronic Communications Act 2000 (SA), a transaction is not invalid because it took place wholly or partly by electronic communications, and a transaction includes a contract (section 5).
How the terms are presented still matters. In deciding whether a term is unfair, a court must take into account how transparent it is (ACL section 24(2)(a)). A term is transparent if it is in reasonably plain language, legible, presented clearly and readily available (section 24(3)). In JJ Richards, terms in legal language, in very small print and not drawn to the customer’s attention were not transparent ([60]).
How similar matters tend to play out
Three illustrations of how the law on this page combines on ordinary facts. They are not predictions. Outcome depends on the contract, the evidence and the court.
Lower range. An Adelaide architecture practice with 25 staff stores its project files with a global cloud storage provider on click-through terms. The terms let the provider change them by posting new terms online. The contract is a small business contract (section 23(4)), so a one-sided variation right can be tested as unfair (section 25(d)). The practical protection is a second copy of the data the practice controls.
Middle range. A start-up builds its software on an infrastructure platform and tells its business customers their data stays in Australia, but deploys to an overseas region to save cost. The statement is likely to be misleading or deceptive conduct in trade or commerce (ACL section 18), and the customers’ APP 8 position changes without their knowledge. Choosing the Australian region, and describing it accurately, removes both problems.
Upper range. A medical practice moves patient records to a cloud platform and misconfigures access, and the records are exposed. Because it provides a health service and holds health information, it is covered by the Privacy Act whatever its turnover (section 6D(4)(b)). It must assess within 30 days and notify if the breach is eligible. Its own configuration failure is not answered by the provider’s security promises (APP 11.1).
How we act on cloud agreements
We act for cloud customers and cloud providers. For a customer, the aim is to know what it is signing, move the terms that matter, and plan around the ones that will not move. For a provider or reseller, it is terms that are enforceable and survive the unfair contract terms test.
| Stage | What happens | What we do |
|---|---|---|
| Review | The provider's terms are sent before migration. | Identify data location, support access, sub-processors, variation, suspension and exit terms. |
| Negotiation | The business seeks changes or a reseller agreement. | Negotiate regions, notice periods, service levels, caps and data export. |
| Data mapping | Personal information is identified for migration. | Advise on APP 8, the storage-only position and the customer's own security duties. |
| Incident | Data is exposed or a service fails. | Advise on the 30 day assessment, notification, credits and termination rights. |
| Exit | The business moves provider or brings systems back. | Enforce export, transition and deletion terms. |
We cannot promise an outcome, and no lawyer can. We can make sure the business knows what its cloud agreement says before it depends on it.
Every hour matters. Book a same-day free 30-minute consultation, or call (08) 7094 2021 now.
Cloud services case law
Valve concerned digital supply over the internet. The other decisions deal with the security, unfair terms, penalty and construction points that every cloud agreement raises.
| Case | Court | Principle | Pinpoint |
|---|---|---|---|
| ACCC v Valve Corporation (No 3) [2016] FCA 196 | Federal Court | Downloaded software is goods; the core of a digital supply | [137], [157] |
| Valve Corporation v ACCC [2017] FCAFC 224 | Full Federal Court | Guarantees apply despite a foreign proper law; no contracting out | [103], [107] |
| Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224 | Federal Court | Overreliance on providers; inadequate provider assessment | [52], [77], [78] |
| ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224 | Federal Court | Price variation and automatic renewal unfair; transparency | [56] to [58], [60] |
| ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928 | Federal Court | Unfair terms in equipment, software and support contracts | [1] to [3] |
| Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28 | High Court | When a sum payable on default is a penalty | [29], [69] |
| Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82 | High Court | How exclusion and limitation clauses are construed | [16] |
Case notes
ACCC v Valve Corporation (No 3) [2016] FCA 196
Edelman J held that a supplier of downloaded games supplied consumers with goods, the definition having been extended in 2011 to include computer software ([137]). Not everything it supplied was a good, but at the core of the supply was software ([157]).
Valve Corporation v ACCC [2017] FCAFC 224
The Full Court rejected the argument that the consumer guarantees did not apply because the contract’s proper law was foreign ([103]), and said the evident purpose of section 64 is that parties cannot contract out of the guarantees ([107]).
Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224
The company had not taken reasonable steps to protect personal information, in part because of its overreliance on third party service providers ([52]). Its reliance on an external provider’s assessment that monitored 3 of at least 127 affected computers was unreasonable, because it knew the assessment was limited ([77] to [78]).
ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224
A unilateral price variation clause with no matching right to terminate, and an automatic renewal clause, created a significant imbalance ([56]). The supplier did not show the terms were reasonably necessary ([57] to [58]), and the terms were not transparent ([60]).
ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928
The respondents supplied office equipment with associated software and ongoing support ([1]). After mediation, Stewart J made consent declarations that ten categories of terms in their small business contracts were unfair and void ([3] and orders).
Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28
Kiefel J, with French CJ agreeing, asked whether a sum payable on default is out of all proportion to the interests the provision protects ([29]). The appellants did not establish that the late payment fee was a penalty ([69]).
Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82
On appeal from South Australia, the High Court held that exclusion and limitation clauses are construed according to their natural and ordinary meaning, in light of the contract as a whole, and where appropriate against the party relying on them in case of ambiguity ([16]).
Frequently asked questions
What should a cloud services agreement include?
The services and regions, availability and service credits, security responsibilities, incident notice, price changes, suspension, use of the customer’s data, data export and deletion, and the exit process.
Can a business negotiate a cloud provider's standard terms?
Sometimes. Global providers rarely negotiate small contracts, but resellers, local providers and larger contracts often do. Where terms cannot change, a cloud services agreement lawyer can show which risks the business must manage itself.
Is storing data with an overseas cloud provider a disclosure under APP 8?
Often. The Information Commissioner’s APP guidelines say a storage-only arrangement may be a use rather than a disclosure, where a binding contract confines the provider and leaves the customer in effective control. Otherwise APP 8.1 applies, and the customer can be liable for the provider’s acts (section 16C).
Is an overseas cloud provider bound by the Privacy Act?
It can be. The Act extends to acts outside Australia by an organisation that carries on business in Australia (section 5B(1A) and (3)). That does not remove the customer’s own obligations.
Who is responsible for security in a cloud service?
Both parties, for different layers. The customer must take reasonable steps to protect personal information it holds (APP 11.1), and overreliance on providers counted against the company in the Australian Clinical Labs case ([52]).
Do the consumer guarantees apply to cloud services?
Where the customer is a consumer, including a business paying $100,000 or less (ACL section 3 and regulation 77A). Services must be rendered with due care and skill and be fit for a purpose made known (sections 60 and 61).
Can a cloud provider change its terms or prices during the contract?
Only as the contract allows. In a standard form consumer or small business contract, a one-sided right to vary the terms, the services or the price without a right to terminate may be unfair (ACL section 25(d), (f) and (g)).
Are cloud service credits enforceable?
Generally, if they are not out of all proportion to the interests they protect (Paciocco v ANZ, Kiefel J at [29]). The practical question is whether the credits are worth claiming, and whether repeated failure allows termination.
How does a business get its data back when it leaves a cloud provider?
Through the export, transition and deletion terms in the agreement. A provider that no longer needs personal information must take reasonable steps to destroy or de-identify it (APP 11.2).
Is a click-through cloud agreement binding?
Usually. A transaction is not invalid because it took place by electronic communications (Electronic Communications Act 2000 (SA) section 7(1)). Whether its terms are transparent is relevant to whether they are unfair (ACL section 24(2)(a) and (3)).
Do critical infrastructure laws apply to cloud providers?
To some. A provider storing or processing business critical data for government or for the responsible entity for a critical infrastructure asset may hold a critical data storage or processing asset (SOCI Act section 12F).
Do I need a cloud services agreement lawyer?
For a migration the business will depend on, yes. A cloud services agreement lawyer can settle data location, security, variation and exit before the data moves. A free 30-minute consultation will tell you where you stand.