Canberra's data centre market exists mainly to host Australian Government systems and data. It is the only Australian market where most demand is determined by government security classification, certification and ownership conditions rather than price and latency. The largest operator is CDC Data Centres, which was founded in Canberra and lists more than 250 MW of capacity across its Canberra campuses. CDC says it holds the highest security accreditations under the Australian Government's Hosting Certification Framework.
For suppliers and operators, Canberra works differently from Sydney or Melbourne. Certification, security clearances, sovereign ownership conditions and government procurement panels often matter more than capacity and cost.
Why Canberra is a different data centre market
| Factor | Canberra | Sydney and Melbourne |
|---|---|---|
| Main customers | Commonwealth departments and agencies, defence, national security, and their contractors | Cloud providers, enterprise, financial services, AI |
| Deciding requirement | Hosting certification, security classification, ownership and control | Capacity, power availability, latency, price |
| Procurement | Government panels and formal procurement rules | Commercial negotiation |
| Scale | Tens of MW per campus | Hundreds of MW per campus |
Hosting Certification Framework
What is the Hosting Certification Framework?
The Hosting Certification Framework (HCF) is run by the Digital Transformation Agency (DTA). It certifies data centre and cloud providers that host Australian Government data. The DTA released the framework in 2021 to address data sovereignty concerns. Agencies must host sensitive government data, whole-of-government systems and systems classified at PROTECTED level with certified providers (iTnews; Holding Redlich).
There are two certification levels:
| Level | What it means |
|---|---|
| Certified Strategic | The highest level. The government can specify ownership and control conditions, and the provider gives contractual undertakings restricting significant changes of ownership, control or operations that would change agencies' risk profile |
| Certified Assured | Protects against later changes of ownership or control through financial penalties that cover the Commonwealth's transition costs |
Australian ownership is not a formal requirement, even for Certified Strategic. The framework relies on contractual control rather than a nationality test.
Current certifications are listed on the HCF register. Check the register rather than relying on marketing claims.
Operators
| Operator | Canberra facilities | Capacity | Notes |
|---|---|---|---|
| CDC Data Centres | Hume Campus One (HU1–HU3) | 21 MW | Operating |
| CDC Data Centres | Hume Campus Two (HU4–HU5) | 51 MW | Operating |
| CDC Data Centres | Fyshwick Campus (FY1–FY2) | 45 MW | Operating |
| CDC Data Centres | Beard Campus (BE1) | 39 MW | Under construction |
| Australian Data Centres (ADC) | Fyshwick, 105 Gladstone Street (acquired from Verizon) | Not publicly disclosed | Certified Strategic; capital works under way (ADC) |
| Equinix | CA1, 51 Dacre Street, Mitchell | Not publicly disclosed | Operating |
A note on CDC's figures. The per-campus capacities on CDC's Canberra page add up to about 156 MW including Beard. The same page gives total Canberra capacity as "250+ MW". The difference probably reflects planned capacity beyond the listed buildings, but CDC does not break it down.
CDC has operated in Canberra since 2007 and has since expanded to Sydney, Melbourne, Perth and Auckland.
Operator profiles: CDC Data Centres · Equinix
Government Workloads and Sovereign Infrastructure
In Canberra, "sovereign" usually covers four separate questions. They are often run together, but they have different answers:
- Data location. Is the data physically held in Australia?
- Ownership and control. Who owns the provider, and can ownership change without government agreement? This is the question the HCF addresses.
- Personnel. Are staff with access to systems security-cleared Australian personnel?
- Legal jurisdiction. Can a foreign government compel access to the data?
Hyperscale cloud providers operate in Canberra alongside the colocation operators. Microsoft's Azure Australia Central regions are in Canberra. Firmus's Project Southgate expansion with CDC names the ACT among its planned AI locations (Firmus).
Large data centres are also covered by the Security of Critical Infrastructure Act 2018. Its obligations for critical data storage and processing assets apply to operators wherever they are located, but they matter most in a market built around government customers.
Security Requirements
Canberra facilities hosting classified workloads are typically designed and operated for:
- Physical security matched to the classification level: perimeter security, hardened construction, multi-factor access control, mantraps and 24/7 on-site security operations. CDC's Canberra page lists 24/7 on-site security.
- Security-cleared personnel for staff and, in many cases, contractors working inside secure areas.
- Separation of government customers into dedicated halls or suites.
- Alignment with Australian Government security frameworks, including the Information Security Manual and the Protective Security Policy Framework, applied by agencies to the systems they host.
For contractors, this means site work in Canberra facilities often requires cleared personnel, escorted access and additional documentation. That limits the pool of eligible trades and suppliers.
More: Data centre physical security
Procurement
Commonwealth agencies usually buy data centre facilities through the DTA's whole-of-government Data Centre Panel, available through the BuyICT platform. According to the DTA and industry reporting:
- The panel covers data centre facilities, including colocation and prefabricated data centres.
- The DTA ran a request for tender to refresh the panel, which closed on 17 October 2025, with evaluation scheduled to finish by March 2026 (DTA).
- The DTA estimated that non-corporate Commonwealth entities would spend about $100 million a year through the panel (techpartner.news).
Construction and equipment work inside operators' facilities is procured commercially by the operator, not through government panels.
More: Data centre tenders and procurement
Power and Location
The ACT is part of the NSW region of the National Electricity Market. Evoenergy is the ACT distribution network, and Transgrid provides transmission. Canberra's campuses are in industrial and commercial precincts (Hume, Fyshwick, Beard and Mitchell) rather than a single cluster.
Canberra's campuses are tens of megawatts each, so their grid connections are much smaller than the gigawatt-scale requests now queuing in Western Sydney. The 39 MW Beard campus is a similar scale to Canberra's existing campuses, not a new hyperscale tier.
Latest Canberra Developments
2026. CDC lists its Beard campus (BE1, 39 MW) as under construction. Source
2026. Australian Data Centres integrates its acquired Fyshwick campus, which is Certified Strategic, and begins capital works to increase capacity. Source
October 2025. The DTA's Data Centre Panel refresh tender closes. Source
Frequently Asked Questions
Why are there so many government data centres in Canberra?
Commonwealth agencies are headquartered in Canberra, and classified systems are easier to operate and staff close to the agencies and security personnel that use them. Certification under the Hosting Certification Framework has further concentrated government hosting with certified providers, several of which operate in Canberra.
Does a data centre need to be Australian-owned to host government data?
No. The Hosting Certification Framework does not require Australian ownership. Certified Strategic providers must accept government-specified ownership and control conditions.
Who are the main data centre operators in Canberra?
CDC Data Centres (Hume, Fyshwick and Beard), Australian Data Centres (Fyshwick) and Equinix (Mitchell).
Supplying Government-Focused Data Centres?
Canberra facilities need suppliers who can meet security, clearance and documentation requirements as well as technical ones. AISB helps specialist suppliers show that capability to the operators and contractors who buy it.
Sources & Verification
- CDC Data Centres: Canberra locations. Link
- Australian Data Centres: Fyshwick acquisition. Link
- Hosting Certification Framework: service provider register. Link
- iTnews: DTA hosting certification regime. Link
- Holding Redlich: Data sovereignty and the HCF. Link
- DTA: Data Centre Panel refresh. Link
- Equinix: Australia colocation. Link
See something that needs updating? Submit a correction.
