Data residency refers to the geographic location where data is stored and processed, such as an Australian data centre versus servers in the United States or Europe. A related idea, data sovereignty, is that data is subject to the laws of the country where it sits.
Cloud and AI services often process data in several places. A chatbot may send prompts to a model hosted overseas, and logs, backups and support access might sit elsewhere again. Many providers offer regional options for an extra cost or on higher plans.
In Australia, the Privacy Act has rules about disclosing personal information overseas, and some industries or government customers have their own requirements. A retailer should ask each AI vendor where data is stored, where it is processed, who can access it and whether an Australian option exists. Check current rules and seek advice for your situation.
Pitfalls include assuming "Australian company" means Australian servers, not asking about AI model processing separately from storage, and forgetting backups and sub-processors.
It matters because location affects privacy obligations, legal access by foreign authorities, and sometimes speed. For many small businesses overseas processing is acceptable if disclosed and safeguarded, but it should be a deliberate, documented choice.