Who controls your energy data? Residency, jurisdiction and control in Australia

Control over your energy data is a question of which laws govern your utility data, where that data physically sits, and who can compel access to it or withhold it from you. For an Australian business it covers three separate things that usually get treated as one: residency, jurisdiction, and control. Only the first is about geography, and on its own it settles very little.

For most commercial energy buyers the practical risk is not a foreign government reading their consumption data. It is discovering, halfway through an assurance review or a retailer switch, that the only complete copy of five years of billing history belongs to somebody else.

What does control over energy data mean?

Control over energy data describes the legal and practical hold a business has over its own utility data: interval and meter reads, invoices, contract terms, emissions calculations, and the reports built on top of them. Three layers sit underneath the term, and they are not interchangeable.

Data residency: the physical location of the servers holding your data. Residency is a fact about geography and nothing more. A data centre in Sydney satisfies it.

Jurisdiction: whose law can reach the data and the entity holding it. Residency does not answer this. Data stored in Australia by a company incorporated overseas can still be exposed to that country's legal process, because the order attaches to the provider rather than to the disk.

Control: whether you can retrieve your data in a usable form whenever you want, and who else holds a copy. This is the layer that decides whether you keep operating when a vendor relationship ends.

Australia and the United States signed a CLOUD Act agreement on 15 December 2021, and it is now in force. It provides a framework for authorities to obtain electronic data from covered providers in the other country for serious crime, subject to targeting restrictions, privacy protections and oversight. It illustrates the principle: the location of a server and the reach of a law are different questions.

Why does utility data end up outside your control?

Utility data has an unusual custody chain. Several parties hold a version of it, and almost none of them has an obligation to keep your history for you.

Your retailer holds the billing history: and the statutory right to get it back is narrower than most buyers assume. Rule 28 of the National Energy Retail Rules requires a retailer to promptly provide a small customer with two years of historical billing data on request, without charge. A small customer is generally one consuming below 100 MWh of electricity a year at the premises (the threshold is higher in South Australia and Tasmania) or 1 TJ of gas, under the National Energy Retail Regulations. Most commercial sites worth managing closely sit above that threshold, so the protection does not apply and access becomes whatever the supply contract says it is.

Metering data passes through several hands: the metering coordinator, the metering data provider, AEMO's market systems, and the retailer each hold a version of the reads for your connection points. Each holds it for their own purpose. None of them is assembling a portfolio view on your behalf.

Your consultant may hold the only validated copy: the cleaned, tariff-checked, site-apportioned version of your data usually lives in the adviser's own tooling. The raw invoices remain yours. The utility intelligence built from them often is not, and it is the part that took three years to accumulate.

Your own systems fragment it: invoices in finance, meter data in a spreadsheet on a shared drive, emissions figures in a model somebody built and left behind. Data you technically own but cannot assemble is not much more useful than data you do not hold at all, which is the structural problem with running a portfolio on spreadsheets.

Which Australian rules govern your energy data?

There is no single Australian law on who controls energy data. Four regimes do most of the work, and they apply to different slices of the same dataset.

Corporations Act record-keeping: the most concrete residency requirement most reporters will meet. Section 286 requires financial records to be retained for seven years. Section 286A extends the same seven-year retention to sustainability records, which must correctly explain and record how the substantive provisions of the sustainability report were prepared. Under section 289A, where sustainability records are kept outside Australia, sufficient written information to enable those provisions to be prepared must be kept in Australia, and ASIC can direct that the offshore records be produced. ASIC sets out its expectations in Regulatory Guide 280.

Climate reporting and assurance: once your energy consumption feeds a Scope 2 figure in a climate statement, it stops being operational data and becomes assurable evidence. Group 2 entities began reporting for periods starting 1 July 2026, and an assurance provider works backwards from the number to the invoice. A meter read you cannot trace to a source document is a number you cannot defend.

Privacy Act 1988: applies to the extent your utility data includes personal information, which it often does through tenant, occupant, and site contact records. Under Australian Privacy Principle 8, an entity that discloses personal information to an overseas recipient generally remains accountable for what that recipient does with it, which is why offshore sub-processors are your exposure and not just your vendor's. From 10 December 2026 a new transparency obligation added to APP 1 by the Privacy and Other Legislation Amendment Act 2024 requires privacy policies to disclose where personal information is used in automated decisions that could significantly affect a person's rights or interests. The OAIC published an APP 1.7 to 1.9 fact sheet, flowchart and updated APP 1 Guidelines on 30 September 2026.

Consumer Data Right: the closest thing Australia has to a legislated energy data portability right. CDR went live in energy on 15 November 2022, with retailers as primary data holders and AEMO as a secondary data holder operating a gateway to market data. Two limits matter. It covers the National Electricity Market only, so there is no coverage for the Western Australian market, and none at all for gas, water, or waste. And it moves data to an accredited data recipient at the consumer's direction, so it is a sharing mechanism rather than an archive you control.

Security of Critical Infrastructure Act 2018: electricity, gas, water, and sewerage are all covered sectors, and 2024 amendments brought data storage systems holding business critical data inside the definition of a critical infrastructure asset. Business critical data includes personal information about at least 20,000 individuals and information relating to the systems needed to operate a critical infrastructure asset. If your organisation runs a covered asset, the systems holding its operational data may carry obligations of their own.

How do you assess a utility platform's data controls?

Seven questions separate a defensible arrangement from a comfortable assumption. None of them needs a security specialist to ask, and the answers belong in the contract rather than in a sales deck.

Where is the data stored, and who owns the storing entity? Ask for the hosting region and the corporate group of the provider and its sub-processors. Two different answers, both of which you want in writing.

Which entity are you contracting with? An Australian trading name does not always mean an Australian contracting party. Check the ABN on the agreement and which country's law governs it.

Can you export everything, without asking? Self-serve export of raw and processed data through an API or a bulk download is the test. If retrieving your own history requires a support ticket and a fee, you have access rather than control.

What happens on termination? Look for a defined export window, a deletion commitment, and confirmation that seven years of records survive the end of the subscription in a form you hold.

Who else touches the data? Sub-processors, offshore support teams, and third-party model providers all count. Under APP 8 their handling is still your accountability.

Is your data used to train models? Consumption profiles reveal operating hours, production runs, occupancy, and shutdowns. Whether that material trains a shared model, and whether you can opt out, should be an explicit contract term.

Can you reconstruct a report from three years ago? Assurance runs on point-in-time evidence, not current dashboards. If a restated tariff quietly rewrites last year's figures with no audit trail, the platform cannot support a climate statement.

How Utilified approaches utility data control

Utilified was built around a single data spine rather than a set of connected tools. UMS, the unified utility management system, holds customers, sites, connections, and registers across electricity, gas, water and LPG in one hierarchy. One place to look means one place to export from, and one version of history that does not depend on which spreadsheet you opened.

UMS checks invoice charges against available tariff and consumption data, with discrepancies flagged for review. The scope of each check depends on the connection, its tariff configuration and the data available. That supports review of your invoice history and the evidence behind it.

Joule's invoice-reading workflow extracts structured data from source documents, applies data-shape and business-rule checks, and flags records for review when checks or confidence thresholds require it. Retaining the source document alongside the extracted data helps a reviewer check the figures rather than rely on the extraction alone.

The UPI REST API provides programmatic access to platform data. Confirm the records, formats and permissions included in your export workflow during procurement. For consultants, UMS Portal delivers branded client views on top of the same platform records.

Here is where Utilified stands on the questions above. Customer data is stored in Australia, in AWS Sydney (ap-southeast-2). AI features work differently: invoice reading sends the relevant document to OpenAI, and Joule sends your question and the data it needs to Anthropic, and both may process it outside Australia, including in the United States. We do not guarantee that all processing happens in Australia, or that only Australian law can reach your data. Our privacy policy lists the providers involved.

One honest note on the procurement question this article is really about. Hosting regions, sub-processor lists, contracting entity, and export and deletion terms are commercial matters, and you should get them in writing from every vendor you shortlist. That includes us. Ask during procurement, not after the data is loaded.

Book a demo →

Frequently asked questions

What is the difference between data residency and jurisdiction?

Data residency is where the data physically sits. Jurisdiction is which laws govern it and who can compel access. Storing data in an Australian data centre answers residency, but if the operating entity sits in another jurisdiction, that country's legal process can still reach the provider. Residency is necessary for some obligations and sufficient for almost none.

Does the Consumer Data Right give my business access to its own energy data?

Partly. CDR has operated in energy since 15 November 2022 and lets a consumer direct a retailer or AEMO to share specified data with an accredited data recipient. It covers the National Electricity Market only, so Western Australia sits outside it, and it does not extend to gas, water, or waste. It is a directed sharing right rather than a portfolio archive you hold yourself.

Can I make my retailer give me my historical billing data?

If you are a small customer, yes. Rule 28 of the National Energy Retail Rules requires a retailer to promptly provide two years of historical billing data on request, free of charge, with a reasonable charge permitted for earlier periods or more than four requests in twelve months. A small customer generally consumes below 100 MWh of electricity a year at the premises (higher in South Australia and Tasmania) or 1 TJ of gas. Above those thresholds the obligation falls away and your access depends on the contract, which is a good reason to hold your own copy.

How long do I need to keep energy data for climate reporting?

Section 286A of the Corporations Act requires sustainability records to be kept for seven years after the report they relate to is completed, and they must correctly explain how the substantive provisions of the report were prepared. Where records sit offshore, section 289A requires sufficient written information to be held in Australia to enable the report to be prepared. In practice that means the invoices and meter data behind a Scope 2 figure, not just the finished report.

Does the SOCI Act apply to my utility data?

It applies if you own or operate a critical infrastructure asset, which covers assets across the electricity, gas, water, and sewerage sectors among others. The 2024 amendments extended the definition of a critical infrastructure asset to data storage systems holding business critical data, so the platforms holding that operational data can be in scope too. A commercial energy buyer who is not a covered operator is generally outside it, but should still check whether any site or subsidiary is captured.

What should a utility software contract say about data ownership?

At a minimum: that you own your data, the hosting region and contracting entity, a named sub-processor list with change notice, self-serve export of raw and processed data in a documented format, a defined post-termination export window and deletion commitment, and an explicit position on whether your data trains any model. Ask for all of it before implementation, when you still have negotiating power.