Data Sovereignty and Security: The Questions to Ask a Workforce Software Vendor

Data sovereignty usually means your data is stored in a particular country and governed by its laws. For an Australian business buying workforce software, it comes down to three questions: where the vendor hosts your people’s data, who can reach it, and what the contract lets you do with it when you leave. Ask all three in writing before you sign.

Workforce software is not the place to be vague about this. A rostering and compliance platform ends up holding the most personal file you keep on anyone in the business: their licences and tickets, fitness for work records, mobile number, emergency contact, the sites they work on and the hours they did. Multiply that by every employee, labour hire worker and subcontractor on the books, and the vendor is holding a register you’d never leave on the seat of a ute.

This guide covers the rules that apply, the questions to ask and what good answers sound like. It’s general information, not legal advice, and your own adviser should check how the Privacy Act applies to your business.

What a workforce platform actually holds

Most of the data in a workforce system arrives one sensible record at a time, which is why nobody adds it up. Add it up before you choose a vendor, because the list decides how hard you need to push.

The fit for work guide covers what those medical records involve, and the records you must keep guide covers what the Fair Work rules require you to hold onto. Both lists end up in the same system, which is the point of having one.

Which privacy rules apply to your business

The Privacy Act 1988 and its Australian Privacy Principles don’t apply to every business in the same way, and workforce data sits across two of its biggest carve-outs.

The small business threshold. The OAIC’s small business guidance says most businesses with an annual turnover of $3 million or less aren’t covered, though some are regardless of turnover, including health service providers and contractors providing services under a Commonwealth contract. Check which side of it your business sits on before you assume the Act is someone else’s problem.

The employee records exemption. The OAIC’s employment page says a private sector employer’s handling of employee records is exempt from the Privacy Act if it’s directly related to a current or former employment relationship. That exemption is narrower than it sounds on a field crew. It covers your employees’ records. Subcontractors, labour hire workers placed with you and job applicants aren’t your employees, and the OAIC says unsuccessful applicants may be able to access their information under the Act.

The overseas rule. When a covered business discloses personal information to an overseas recipient, Australian Privacy Principle 8 requires it to take reasonable steps to ensure the recipient doesn’t breach the principles, and section 16C makes the business accountable if the recipient does. The OAIC’s APP 8 guidelines say giving data to an overseas cloud provider purely to store it may count as a use rather than a disclosure, but only where a binding contract limits the provider to that purpose, binds its subcontractors and gives you effective control of the information.

The OAIC’s list of issues to consider in that case reads like a vendor questionnaire: whether you keep the right to access, change or retrieve the information, who else can access it and for what purposes, what security measures protect it, and whether it can be retrieved or permanently deleted at the end of the contract. Those are good questions whether your data leaves the country or not.

Where breaches actually come from

The OAIC’s statistics for January to June 2025 counted 532 notifiable data breaches. Malicious or criminal attacks caused 59% of them, 308 notifications, with cyber security incidents the main source. Human error caused 37%, 193 notifications, up from 29% in the previous six months.

Both halves of that number are workforce problems. The attacks go after credentials, and a field business has a lot of them: every worker with an app login, every supervisor with admin rights, every leaver whose account was never switched off. The human error is the roster emailed to the wrong list, the spreadsheet of licences attached to a tender, the group chat with 60 personal phone numbers in it. A vendor’s security is only half the answer. The other half is whether the system makes the careless version harder than the careful one.

Where the data lives, and who can reach it

The Australian Signals Directorate’s cloud computing security guidance for tenants is blunt about whose problem this is. Security is shared between the customer and the cloud provider, “however, organisations are ultimately responsible for protecting their data”. Buying software doesn’t buy you out of that.

Location is the easy question and the one vendors answer best. Ask it in full anyway: the country and city of the primary hosting, the hosting provider underneath the vendor, where backups are kept, and where the vendor’s own support and engineering staff sit, because a support engineer overseas looking at your records is access from overseas whatever the server’s postcode.

Access is the harder question. Ask who at the vendor can see customer data, under what approval, and whether that access is logged. Ask how your own people sign in. Single sign-on through your existing Microsoft accounts means the sign-in rules your IT team already sets apply to the workforce app too, and a leaver loses access when their Microsoft account is switched off. The Microsoft single sign-on guide covers the questions IT should ask, including the mobile gap many vendors skip.

The way out: exports, deletion and backups

Most security questionnaires stop at the front door. The ASD’s guidance spends just as long on the back door, and a field business should too, because the day you change systems or the vendor changes owners is the day this matters.

The ASD’s tenant mitigations include keeping up-to-date backups “in a format avoiding CSP lock-in” and testing the recovery process every year, contractually retaining legal ownership of your data, and reviewing the provider’s contract and financial viability as part of due diligence. Translated for workforce software, that’s three asks:

• A full export in a usable format. Every worker, every credential with its expiry, every roster and approved timesheet, in a file another system could import. Ask to see one, not hear about one.
• Deletion you can confirm. What happens to your data at the end of the contract, how long it takes and how you’ll know it’s done.
• Recovery that has been tested. How often backups run, where they’re kept and when a restore was last tested.

The buyer’s guide to workforce management software covers the wider selection process. This is the part of it that’s cheapest to settle before you sign and dearest to argue about afterwards.

The questions to ask, and what good answers sound like

A vendor that answers every row on the call and none of them in writing hasn’t answered. Ask for the responses as a document, and ask for the hosting, breach notice, exit and ownership answers to appear in the contract itself.

Questions to ask yourselves

The vendor is half the risk. The other half is how the business uses the system once it’s in.

• Who is an admin? Count them. Admin rights tend to spread to whoever asked for them, and every admin account is a key to the whole register.
• Who leaves without being switched off? Pull the list of leavers from the last 12 months and check how many still have access to anything.
• Where does the data leak out sideways? Rosters exported to spreadsheets, licence copies in email, crew lists in group chats. A good system makes those exports less necessary. It can’t stop someone attaching a spreadsheet.
• What would you do on the day? Name who decides whether a breach is notifiable and who talks to the vendor. The ASD’s advice is to have an incident response plan and test it every year.

How Humanz answers the questions it can answer here

Humanz data is hosted in Australia, in Sydney, and support is Australian-based, so you deal with the team that builds the product. Humanz supports Microsoft single sign-on across the web app and the mobile app, so field crews and the office sign in with the accounts IT already controls, and a leaver’s access goes when their Microsoft account does.

Inside the platform, documents sit in storage with role-based access, so who sees what is set by your roles rather than by who asked. Timesheet approvals and compliance overrides are recorded on an audit trail, so changes have a name and a time against them. Rosters publish to the app rather than to a spreadsheet, and messages sit against the job instead of a group chat full of personal numbers, which takes away a lot of the sideways leakage the breach statistics describe.

This page doesn’t publish our answers on certifications, backup and retention, or export and deletion. Ask us for them in writing, the same as you should ask any vendor, and judge them by the table above. That is what workforce management software should be able to give you: answers on paper, before your crew’s records move in.

If you’re comparing vendors now, send each one the question table above as written questions, with a deadline. How quickly and how specifically they answer tells you most of what you need to know.

Frequently asked questions

What does data sovereignty mean in Australia?

Data sovereignty usually means data is stored in a particular country and is subject to that country’s laws. For an Australian business it generally means keeping personal information hosted in Australia and knowing who can access it from elsewhere. Hosting location is only part of it: where backups are kept, where the vendor’s support staff work and what the contract says all matter too.

Does the Privacy Act apply to workforce software?

The Privacy Act applies to the business, not the software, and it covers most businesses with annual turnover above $3 million plus some smaller ones regardless of turnover. A private sector employer’s handling of employee records is exempt where it’s directly related to the employment relationship. That exemption doesn’t extend to subcontractors, labour hire workers or job applicants, because they aren’t the business’s employees.

Is it legal to store employee data overseas?

Storing data overseas isn’t prohibited, but a covered business that discloses personal information to an overseas recipient must take reasonable steps to ensure the recipient doesn’t breach the Australian Privacy Principles, and is accountable if it does. Giving data to an overseas cloud provider purely for storage may count as a use rather than a disclosure, but only where a binding contract limits the provider to that purpose and keeps the business in effective control of the information.

What security questions should I ask a software vendor?

Ask where data is hosted and with which provider, where backups and support staff are located, which certifications or independent assessments the vendor holds, and how users sign in. Ask who at the vendor can see customer data, how breaches are notified, how you export your data and in what format, and what happens to it when you leave. Get the answers in writing and the key ones in the contract.

What causes most data breaches in Australia?

Malicious or criminal attacks caused 59 per cent of the 532 notifiable data breaches reported to the Office of the Australian Information Commissioner from January to June 2025, with cyber security incidents the main source. Human error caused 37 per cent, up from 29 per cent in the previous six months. For field businesses, that points to credentials and to careless sharing of rosters, licence copies and contact lists.

Where is Humanz data hosted?

Humanz data is hosted in Australia, in Sydney, and support is Australian-based. Humanz supports Microsoft single sign-on across both the web and mobile apps, so crews sign in with the accounts the business already manages. For certifications, backup and retention, and export and deletion, ask Humanz directly and get the answers in writing, as you would with any vendor.