Sector-specific data residency as design constraint

Some sectors, like health and finance, place stricter limits on where data may be processed than general privacy law does. When a citizen reaches a government service in one of those sectors through an AI agent, the agent and the platform behind it have to honor those limits, keeping the data on compliant infrastructure, and the citizen should be able to see that it held.

The challenge is to make a sector's residency rule something the platform enforces before it routes a request, and something the citizen can actually see.

Australia's My Health Records Act — section 77. Under section 77, all My Health Record data must remain in Australia, including all copies and backups, with no exceptions unless it is non-identifiable operational data held by the System Operator. This is an absolute geographic restriction: no offshoring, no exceptions. Individual states and territories impose additional restrictions on disclosure outside their jurisdiction without consent.

HIPAA (US) — no residency mandate, but practical constraints. HIPAA does not mandate US-only storage. It requires encryption, access controls, audit trails, and a Business Associate Agreement (BAA) with cloud vendors. However, many enterprise health-system customers contractually require US-based hosting, making data residency a market-driven rather than regulatory constraint. Data residency for healthcare AI covers where PHI is stored, processed, queried, and where AI inference runs, not just server location.

APRA CPS 234 and CPS 230 (Australian financial services). CPS 234 is the mandatory information security standard for APRA-regulated entities; CPS 230 replaced the outsourcing standard on 1 July 2025, requiring regulated entities to manage cloud risks under a new operational-resilience framework. Together they constrain where and how a regulated service may process data, including through its cloud and AI providers.

UK PRA Critical Third Parties regime. From 1 January 2025, the Bank of England, FCA, and PRA can designate third-party providers (including cloud providers) as Critical Third Parties (CTPs) where their services to UK financial entities are sufficiently systemic. CTPs become subject to direct oversight and must comply within twelve months of designation. The regime addresses concentration risk: the dependency of many financial institutions on a small number of cloud providers.

Sector-specific data-residency requirements create a design constraint that AI agent platforms must encode and enforce, and the form they take varies by jurisdiction. Under Australia's My Health Record regime, for instance, an agent must ensure no data is processed offshore: not the prompt, not the response, not the inference computation. Under the APRA financial-services regime, an agent must satisfy CPS 234 and CPS 230, including personal accountability of executives.

The design pattern is "sector-aware routing": the agent platform must know, before routing a request to an AI model, whether the data involved falls under a sector-specific residency regime and, if so, restrict routing to compliant infrastructure. The US HIPAA framework offers a useful counterpoint, since not all data-residency requirements are statutory. The pattern should distinguish a constraint required by law from one required only by policy.