The Australian Government's Whole-of-Government Cloud Computing Policy took effect on 1 July 2026, creating a single framework for how the public sector adopts cloud services. If you run a plumbing wholesaler in Bayswater or a 40-person allied health practice in Newcastle, none of that is addressed to you. The operational consequence still arrives, and it arrives in the form of a supplier questionnaire — the one your biggest customer's procurement team sends out, six pages long, with a section on data residency you have never had to fill in before.
The uncomfortable part for most Australian SMEs is not that the answers are bad. It is that the answers do not exist on paper. A working n8n instance running twelve automations and a Retool app that four people use daily can be entirely defensible and still fail a compliance review, because nobody has ever written down where it runs, what it touches, and how a customer would get their data back if the relationship ended.
What actually changed, and what did not
The policy standardises cloud adoption across Commonwealth entities. It is a procurement and architecture framework for government, not a law that binds private companies. Nothing in it obliges an SME to change anything.
What changes is the behaviour of the buyers above you. Requirements written for government contracts flow down through prime contractors to their subcontractors, and from there to the small suppliers those subcontractors depend on. Large enterprises that do not sell to government copy public-sector controls anyway, because it is cheaper than drafting their own and it makes their board comfortable. That transmission takes months, not weeks. Six weeks after commencement is roughly when the first reworked questionnaires start circulating.
So the timing question is not whether this reaches you. It is whether it reaches you before or after you have something written down. Being asked in October and answering in November is a bad sequence for a tender.
The five questions to expect
These are the questions that a government-aligned procurement pack tends to ask about any system that processes the buyer's data. Automation platforms count, even though most SMEs do not think of them as systems. An n8n workflow that pulls invoices from Xero, enriches them with a language model, and pushes them into a customer's ERP is a data processing arrangement whether or not anyone has called it one.
1. Where the workload runs
Not "which cloud" — which region, and which country the control plane sits in. n8n Cloud, Retool Cloud, Make, Zapier and every managed automation vendor makes a regional hosting choice on your behalf unless you have explicitly selected otherwise. If you self-host n8n on a VPS, you know exactly where it is. If you use the hosted tier, find out, and find out whether the vendor's management and support infrastructure is in the same jurisdiction as your data. Those are two separate answers and a decent questionnaire asks for both.
2. Which subprocessors touch the data
Every third-party service inside a workflow is a subprocessor. An automation that reads a PDF, calls an OCR service, sends the extracted text to a model, writes to a database and posts a Slack notification has touched at least four external parties in one run. Most SME builds have never had that list enumerated. It is not a hard list to produce — it is the set of credentials in your n8n instance plus whatever your Retool resources connect to — but it takes an afternoon and nobody has spent the afternoon.
3. What the model sees
The AI-specific question, and the one that gets the fastest escalation when the answer is vague. Buyers want to know which model provider processes the content, in which region, whether inputs are retained, and whether they are used for training. If you are calling a consumer-tier API with a personal key and no data processing agreement, that is an answer you will not want to give in writing.
4. How you exit
Termination assistance, data return format, and deletion timeframes. This is where automation stacks are genuinely weaker than the SaaS products around them. Workflow logic lives in a proprietary-ish JSON structure, credentials are stored in the platform, and execution history — which frequently contains customer data — sits in a database nobody has thought about. "You can export the workflows" is not an exit plan. What the buyer's data does on the way out is the question.
5. Who has access and how you prove it
Named users, role separation, and an audit trail. Retool handles this reasonably well because it has real permission groups. Self-hosted n8n at the default configuration often has one shared login used by three people, which is fine operationally and indefensible on a form.
What changes in the build
Very little of this requires rearchitecting. Most of it is configuration and documentation that should have been done during the original build and usually was not.
Pin the region explicitly. Both AWS and Microsoft Azure operate Australian regions, and both make their major model families available through region-scoped services. Routing model calls through a region-pinned enterprise endpoint rather than a direct consumer API is normally a half-day of work in an existing n8n build — swap the credential, adjust the node, retest the prompts. It changes the answer to question three from a shrug to a sentence.
Separate credentials by customer or by domain. One shared API key across every workflow means you cannot revoke access for one client without breaking the others, and you cannot answer an access question honestly. Splitting credentials is tedious rather than difficult.
Set an execution data retention policy. n8n stores execution history including payloads by default. Decide how long you need it — usually 7 to 30 days for debugging — and configure pruning. This single change removes a large volume of customer data from a system nobody is treating as a data store.
Move the things that should not be multi-tenant. If a customer contractually requires their processing to be isolated, that is a decision about self-hosting versus a shared instance, and it is much cheaper to make before you have thirty workflows in one place. Self-hosted n8n and self-hosted Retool both exist precisely for this reason.
Turn on real authentication. SSO where you have it, individual accounts where you do not, and no shared logins on anything that touches customer data.
What to document in the next fortnight
The document set is small. It is the absence of it that costs deals.
| Artefact | What it contains | Rough effort |
|---|---|---|
| System description | What each automation does, what triggers it, what data it moves | Half a day |
| Data flow map | Source, transformations, destinations, retention at each hop | Half a day |
| Subprocessor register | Every third-party service, its function, its hosting region | Half a day |
| Access register | Named users, their role, their last review date | Two hours |
| Exit plan | Export format, deletion timeframe, who executes it | Two hours |
Two days of work, spread across a fortnight, produces a pack that answers most of a standard supplier questionnaire without a scramble. Keep it in a shared document rather than a slide deck, because it needs updating every time a workflow changes and nobody updates slide decks.
The register is the item most often skipped and most often asked for. Build it from your credential list rather than from memory — memory misses the OCR service and the geocoding API every time.
Where not to over-correct
The risk in the other direction is real. There is a category of Australian supplier that reads a government framework, panics, and commits to sovereign-only infrastructure, IRAP assessment, and a compliance posture appropriate to a defence prime, on the strength of one enterprise customer's questionnaire. That is a five-figure detour for a business whose actual requirement was a data flow diagram and a region setting.
The proportionate position for most SMEs is: know where things run, be able to name your subprocessors, keep customer data out of places it does not need to be, and be able to hand it all back. Formal certification is a conversation to have when a specific contract requires it and the contract value justifies it — not a pre-emptive purchase. The broader Australian picture is one of uneven AI adoption across the business population, which means the bar you are clearing is set by your competitors' answers, and most of them have not written theirs down either.
The other reason to do this now is internal rather than external. The exercise of mapping what your automations actually touch reliably surfaces things you did not know were happening — a test workflow still running on a schedule, a credential belonging to someone who left in March, an integration writing to a spreadsheet nobody reads. Compliance work is a poor motivation and a good excuse.
Start with the subprocessor register. Open your n8n credentials list and your Retool resources, write each one into a table with its function and its hosting region, and mark the ones you cannot answer. That list of unknowns is your actual work queue, and it usually takes under an hour to produce. If you want a second set of eyes on what it turns up, book an assessment and bring the table with you.