Australia Just Banned DeepSeek on Government Devices, What It Means for Your Business
On 4 February 2026, Australia's Home Affairs Minister issued a direction banning DeepSeek from all Australian government devices and systems. The reasoning was direct: the tool poses unacceptable risks to national security and government data due to its Chinese ownership, its data storage practices, and the obligations placed on Chinese companies under Chinese national security law.
Australia was not alone. The UK, Italy, South Korea, and several other countries moved quickly to restrict government use of DeepSeek. For Australian small business owners, the question is: does this matter to us?
The short answer is yes, and here is why.
What Prompted the Ban
DeepSeek's privacy policy, which the company publishes openly, states that user data is stored on servers in the People's Republic of China. Under China's National Intelligence Law, any company or individual operating within Chinese jurisdiction is obligated to cooperate with national intelligence agencies when requested. That cooperation is not optional and does not require a court order.
This is the same legal framework that drove Western governments to restrict or ban TikTok on government and official devices. The concern is not that DeepSeek is necessarily actively harvesting your data for a foreign government right now. The concern is that it could be required to hand over stored data, and there is no independent legal mechanism outside of China to challenge or prevent that.
Australia's signals intelligence agency, the Australian Signals Directorate (ASD), had already flagged AI tools with foreign data storage as a risk category for Australian organisations. The DeepSeek ban formalised that concern at the highest level of government direction.
What 70 Percent of Businesses Blocking It Means
Industry cybersecurity reports in early 2026 indicated that around 70 percent of Australian businesses with managed IT services had proactively blocked DeepSeek at the network level, before the official government ban was even announced. That figure is striking because it reflects a rapid, widespread assessment by IT and security professionals that the risk profile was incompatible with responsible business data handling.
For businesses without managed IT services, the picture is less clear. If your team can access DeepSeek through a browser or app on work devices, they may already be using it, and any business data they enter is being stored under Chinese jurisdiction.
Should Your Business Block DeepSeek?
The right answer depends on your situation, but we can offer a clear framework.
If you are a government contractor, work in defence, healthcare, legal services, or handle any client data that is subject to Australian privacy law, the answer is yes, block it immediately. The risk of regulatory non-compliance alone justifies the decision, separate from the security concern.
If you are a small retail business with no sensitive client data and no government relationships, the immediate risk is lower. But we would still recommend against using the DeepSeek app for anything business-related, simply because the data handling practice is not consistent with responsible business behaviour. You would not use a spreadsheet that automatically sent copies of your files to an unknown overseas server. This is the same principle.
The safest practical step for any business is to add a line to your AI tool policy (even if that policy is just a short internal email) that says: do not enter client information, financial data, internal strategies, or personal details into DeepSeek or any AI tool that stores data outside Australia without approval.
What to Use Instead
For most tasks where businesses might reach for DeepSeek, the alternatives are straightforward and not significantly more expensive.
Microsoft Copilot is available through Microsoft 365 subscriptions that many businesses already hold. Microsoft operates data centres in Australia and offers Australian data residency for most of its services. For businesses handling sensitive information, this is the most defensible choice.
Google Gemini (available through Google Workspace) similarly operates Australian infrastructure and is subject to US and Australian law, not Chinese national security law. The risk profile is materially different.
ChatGPT Plus (OpenAI) stores data in the US. OpenAI is subject to US law, which includes its own government access provisions, but the legal framework around those access provisions is considerably more transparent and court-supervised than the Chinese equivalent.
None of these alternatives is perfect from a data sovereignty standpoint, which is why it is always worth being thoughtful about what you paste into any AI tool. But they represent a materially lower risk than tools operating under Chinese jurisdiction.
The ASD's Guidance on Foreign AI Tools
The Australian Signals Directorate publishes guidance for businesses on evaluating foreign technology products. The key questions they recommend asking are: where is the data stored? Who owns the company and what jurisdiction are they subject to? What does the privacy policy actually say, in plain language?
Applying those questions to any AI tool you are considering is good practice regardless of where it comes from. Most reputable providers answer these questions clearly and prominently. If you cannot find the answer easily, that itself is a warning sign.
For Perth businesses, the broader lesson from the DeepSeek situation is that AI tools are not all equivalent from a data handling perspective, and the cheapest or most capable option is not always the right choice for business use. Taking a few minutes to understand where your data goes before you start using a new tool is time very well spent.
If you want help reviewing the AI tools your business is currently using and checking whether they meet a reasonable standard for data safety, this is something we can work through with you quickly.
