29 September 2026
6 min read
#Digital Economy, #Renewable Energy, #Construction, Infrastructure & Projects, #Property & Development
Published by:
Australia’s data centre sector is drawing significant interest from foreign investors, driven by rising demand for cloud services, artificial intelligence and digital infrastructure. The message from Prime Minister Anthony Albanese’s national AI address in July is clear: while investment is welcome, the regulatory environment for data centre projects is becoming increasingly complex.
For foreign investors, Australia’s data centre boom is no longer just about acquiring sites, assessing construction feasibility or deploying capital. Projects now sit at the intersection of national security, critical infrastructure, privacy, energy, water and social licence. Australia’s proposed national AI and data centre framework in 2027 is expected to streamline this complexity.
As demand for AI and cloud infrastructure grows, investors will need to treat regulatory strategy as central to a deal’s feasibility, rather than as a box to tick after commercial terms are agreed.
A key issue for foreign investors is whether an investment involves a ‘national security business’ under Australia’s foreign investment regime. For data centres and cloud providers, this may be the case if the business stores, processes or provides access to defence, intelligence, classified, government or other business-critical data, or involves critical infrastructure or telecommunications.
Where the regime applies, a foreign person may need to notify the Treasurer before starting the business or acquiring a direct interest (generally 10% or more, or an interest that gives the person control) in an entity that carries on such a business, regardless of the transaction value.
Importantly, clearance from the Foreign Investment Review Board (FIRB) is not necessarily the final regulatory hurdle. The Treasurer retains ‘last resort’ powers to impose conditions or require divestment if national security risks emerge, and investments may subsequently be called in for review.
TikTok/ByteDance’s proposed 100-megawatt data centre in either NSW or Victoria shows how national security scrutiny can stall an otherwise commercially viable project. The proposed development has reportedly faced more than a year of FIRB scrutiny concerning foreign ownership, control and access to sensitive infrastructure.
Further FIRB reforms announced in May 2026 may extend mandatory notification and clearance requirements to data centre investments, even where the investor does not hold a direct interest in a critical data storage or processing asset. The government has yet to confirm the specific sectors affected.
Australia’s merger control regime is now mandatory for acquisitions that meet the prescribed thresholds: a notifiable transaction cannot be completed until the Australian Competition and Consumer Commission (ACCC) grants clearance. The regime operates separately from FIRB, which considers national security, while the ACCC considers fair trading and market competition.
Whether notification is required may depend on the transaction value, the parties’ revenue, the assets acquired and the level of control or influence obtained. Both processes should therefore be assessed and factored into the transaction timetable.
A data centre may also be regulated as a critical infrastructure asset under the Security of Critical Infrastructure Act 2018 (Cth), depending on its customers, services and use. This may include providing data storage or processing services to government or entities responsible for critical infrastructure. Where the Act applies, obligations may include registering the asset, reporting cyber incidents and maintaining risk management programs.
These requirements sit alongside broader privacy and data sovereignty obligations. Under the Privacy Act 1988 (Cth), Australian Privacy Principles 11 (security) and 8 (cross-border disclosure) may affect how personal information is stored, processed, accessed and transferred offshore. Foreign-owned operators should address data flows and access arrangements early.
Energy is likely to be the principal infrastructure constraint for large data centres. AI and cloud facilities require substantial, round-the-clock electricity supply and can place sudden, concentrated load on the grid. This raises both connection and system stability issues: new generation, backup capacity and transmission infrastructure may not be delivered quickly enough to match data centre construction timelines.
The Australian Energy Market Commission (AEMC) has recommended measures that would require large data centres to offset their electricity consumption through renewable energy certificates linked to new renewable generation, demonstrate sufficient capacity to maintain a reliable supply (including through storage or other arrangements), and show that they can adjust demand when needed. Proponents may also be required to bear a greater share of the network connection and upgrade costs attributable to their projects.
The practical response is likely to involve a combination of renewable energy generation, storage and flexible demand. Power purchase agreements can secure renewable electricity from off-site generation, while battery energy storage systems (BESS) can help maintain a reliable supply and reduce peak demand.
Water presents a similar constraint. Data centres require continuous cooling, and conventional water-intensive systems can place significant additional demand on local supplies, particularly in water-constrained regions that may otherwise be considered suitable for development. Developers may therefore need to demonstrate how they will minimise water demand and provide any additional water or wastewater infrastructure.
Potential ways to reduce reliance on potable water include recycled or treated wastewater, closed-loop systems and liquid or air-cooling technologies.
Foreign investors should assess whether the surrounding electricity, water and planning environment can support the long-term expansion of data centre activity without creating unacceptable regulatory or social licence risks. Our earlier article examines the environmental impacts of Australian data centres in more detail.
Social licence refers to the level of acceptance and support a project receives from local communities, governments and other stakeholders. Investors should therefore be prepared to demonstrate the tangible benefits their projects will deliver, including employment opportunities, skills development and training, local procurement and community investment.
Importantly, a project’s economic contribution should not be measured solely by the number of construction jobs it creates. Data centres can generate significant short-term employment during development, but their ongoing workforce is typically smaller and more specialised.
Some international operators position data centres as part of the communities in which they operate by supporting initiatives such as local education programs, career pathways, training and community investment. For foreign investors in Australia, this broader value proposition may become increasingly important.
A project that can demonstrate lasting local employment, skills and community benefits is better positioned than one perceived primarily as a significant consumer of land, electricity and water.
For proposed data centre projects in Victoria, new planning, renewable energy and community benefit requirements will also need to be considered. Our article on the Victorian Government’s new data centre rules outlines these requirements.
Australia’s data centre sector presents significant opportunities for foreign investors as demand for cloud services, artificial intelligence and digital infrastructure continues to grow. However, the investment environment is increasingly conditional: projects will need to demonstrate commercial feasibility and alignment with Australia’s national expectations.
In practice, early due diligence is essential. These issues should be assessed together before a transaction becomes binding or a site is selected. As the regulatory framework develops, investors should revisit these issues regularly and build flexibility into transaction and development timelines.
If you have any questions regarding this article or are looking to invest in a data centre in Australia, please get in touch with us.
Disclaimer
The information in this article is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information, we do not guarantee that the information in this article is accurate at the date it is received or that it will continue to be accurate in the future.
Published by:
