Securing land, power, water and development approval are fundamental to a data centre investment. But they do not tell the whole regulatory story.

​

Two physically similar data centres in the same location can have quite different regulatory profiles

​

Ownership, operations, services, information and customers can introduce another layer of regulation. Critical-infrastructure, cyber-security, foreign-investment, privacy, telecommunications and national-security requirements can all become relevant.

​

For investors, understanding these distinctions before acquisition or development is increasingly important.

​

Data centres can be critical infrastructure

​

Australia’s critical-infrastructure regime expressly includes the data storage or processing sector.

​

Under the Security of Critical Infrastructure Act 2018 (Cth) (SOCI), a facility can constitute a critical data storage or processing asset where statutory criteria are satisfied. This can include facilities providing services involving business-critical data relating to government bodies or responsible entities for other critical-infrastructure assets.

​

A facility’s regulatory significance can therefore depend on more than its size, power consumption or physical design. Its customers and the information it supports can matter.

​

Where SOCI applies, obligations can include registration and information requirements, cyber-security incident reporting and critical infrastructure risk-management programs. Some assets may also be subject to enhanced cyber-security obligations.

​

The regulatory framework continues to evolve. Enhanced critical infrastructure risk-management requirements commenced in June 2026 for specified asset classes, while data storage and processing assets remain subject to applicable baseline requirements. Following the 2026 Independent Review of the SOCI Act, further reforms may follow, alongside an increasing focus on regulatory compliance and enforcement.

​

For investors, this creates a due-diligence question not apparent from the physical asset. A facility supporting ordinary commercial workloads may have a different regulatory profile from one servicing government or critical-infrastructure customers. Customer mix can affect both revenue and regulatory risk.

​

Foreign ownership can change the investment pathway

​

Foreign investment is another important consideration given the international capital flowing into Australian digital infrastructure.

​

Investments may require consideration under the Foreign Acquisitions and Takeovers Act 1975 (Cth) and associated regulations. Australia’s Foreign Investment Framework specifically recognises data centre investment. National security considerations can become particularly important where an investment involves critical infrastructure, sensitive data, a national-security business, sensitive land or a foreign government investor.

​

The analysis extends beyond land acquisition. Investor identity, the interest acquired, business activities and subsequent changes in ownership or control can all be relevant. Foreign government investors can face additional requirements.

​

The same asset can therefore present different transaction pathways for different investors. A project may be viable from a planning, environmental, power and water perspective but still raise material foreign-investment or national-security issues. Foreign-investment analysis should occur early in the transaction process.

​

Privacy depends on the operating model

​

Data centres house and process information, but not every participant has the same privacy obligations.

​

The Privacy Act 1988 (Cth) and Australian Privacy Principles apply to entities within the legislation’s scope. Regulated entities must take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. The Notifiable Data Breaches scheme can require notification where an eligible breach is likely to result in serious harm.

​

The question is not simply whether personal information is physically located inside a building. Property owners, data centre operators, colocation providers, managed-service providers, cloud providers and customers perform different functions.

​

Whether an entity holds personal information can depend on its possession or control of the records, rather than their physical location. Contractual and operating structures therefore matter.

​

As data centres increasingly support cloud computing, artificial intelligence, financial services, health services and government, responsibility for information and security becomes more complex. Understanding how that responsibility is allocated is an important part of operational due diligence.

​

Telecommunications laws depend on what the operator actually does

​

The Telecommunications Act 1997 (Cth) may apply depending on the business model.

​

Operating a building containing data infrastructure does not automatically make its owner or operator a telecommunications carrier or carriage service provider. The telecommunications framework can become relevant where an operator owns or operates network infrastructure or supplies telecommunications services within the regime’s scope.

​

The Telecommunications (Interception and Access) Act 1979 (Cth) can introduce additional requirements relating to certain telecommunications services and stored communications.

​

A conventional colocation facility can therefore have a different regulatory profile from an operator providing integrated network, communications, cloud or managed infrastructure services.

​

Government and Defence customers can increase the requirements

​

Data centres supporting government, Defence, critical-infrastructure operators or customers handling sensitive information can face requirements beyond those applying to conventional commercial facilities.

​

Statutory obligations can operate alongside government security standards, procurement rules, contractual obligations and customer-specific accreditation or assurance requirements. For Defence customers, additional requirements may arise under the Defence Industry Security Program (DISP) and Defence Security Principles Framework (DSPF).

​

Data residency, sovereignty and controls over access to information may also influence whether a facility is suitable for particular government workloads.

​

Depending on the services and information involved, these requirements can affect physical access, facility design, cyber security, personnel, supply chains and operating procedures.

​

For investors, there is a trade-off. Government, Defence and critical-infrastructure customers may strengthen the commercial case through high-value or long-term demand, but can also increase security requirements, compliance costs and regulatory exposure. These implications should be assessed when acquiring an operating facility or developing a project around prospective anchor customers.

​

Large operators may encounter additional reporting obligations

​

Other regulatory regimes can become relevant depending on the operator’s scale and corporate structure.

​

The National Greenhouse and Energy Reporting Act 2007 (Cth) establishes reporting obligations where applicable energy and emissions thresholds are met. Given the electricity requirements of large facilities, this should form part of relevant operators’ regulatory assessments.

​

Qualifying entities may also be subject to mandatory sustainability reporting under the Corporations Act 2001 (Cth). Introduced by the Treasury Laws Amendment (Financial Market Infrastructure and Other Measures) Act 2024 (Cth), the phased regime currently requires annual reporting on climate-related financial risks and opportunities.

​

These requirements do not determine whether a data centre can be built, but can affect governance, reporting and disclosure of energy, emissions and climate-related risks.

​

The regulatory map extends well beyond development consent

​

A complete regulatory assessment may need to consider:

​

Physical development: Planning, environment, water, heritage, biodiversity, construction, fire safety, pollution and waste.

​

Infrastructure: Electricity connection, transmission and distribution capacity, water infrastructure, telecommunications and associated works.

​

Ownership: Foreign investment, national security and changes in ownership or control.

​

Operations: Critical infrastructure, cyber security, privacy, telecommunications, energy and emissions reporting.

​

Customers: Government, Defence, critical-infrastructure customers, sensitive information, security accreditation and contractual requirements.

 

Corporate obligations: Governance, climate-related financial disclosure and other applicable reporting requirements.

​

Not every law applies to every facility. That is precisely the point. The regulatory profile depends on the location, ownership, design, scale, operating model and customers of the particular project.

​

Due diligence needs to look beyond the asset

​

Traditional infrastructure due diligence focuses on the physical asset. For data centres, the analysis must go further.

​

Investors should understand ownership and operating arrangements, services provided, foreign-investment requirements, potential critical-infrastructure classification and applicable privacy or telecommunications obligations. The expected customer base also matters.

​

These issues interact. A new government customer may change an operating facility’s security profile. New services may increase telecommunications or privacy obligations. A foreign acquisition may introduce a national-security approval process.

​

A facility can therefore enter a different regulatory environment without significant physical changes. Regulatory exposure may also need reassessment as ownership, services and customers evolve.

​

Development approval is an important milestone, but it is not the end of the regulatory investment equation.

​

For investors, the more useful question is not simply: what approvals does this asset have?

​

It is: What regulatory obligations arise from who owns it, how it operates, what information it supports and who relies on it?

​

In a sector where physical infrastructure, the digital economy and national interest increasingly intersect, the answer can materially affect the long-term value and risk profile of the investment.

 

 

 

Note: This article forms part of a series examining Australia’s changing data centre investment environment. It reflects legislation, government policy and regulatory guidance current as at 8 October 2026. Requirements for individual projects will vary depending on factors including jurisdiction, location, scale, ownership, operating model, infrastructure needs and customers. This article provides general information only and should not be relied upon as legal advice.

​

​