Another key finding of the survey is that decisions to use overseas infrastructure were made predominantly on an ad hoc basis.

Most information ends up in Australia and the US, some is held by overseas third-party ICT solution providers in Singapore, India and the European Union.

Shroff says that while cloud computing has major benefits it also carries some risks, which government agencies and businesses need help in understanding.

"This survey has found that both the private and public sectors need guidance in this area. While most organisations have controls to protect the security of personal information in transit, some have no control over what happens once the information is sent overseas or don't know if they have controls."