There are restrictions in the Assistance and Access Act which mean that a defence against the civil penalty for non-compliance is that it would violate the law

There are restrictions in the Assistance and Access Act which mean that a defence against the civil penalty for non-compliance is that it would violate the law of a foreign country if the act would be done in a foreign country (see s317ZB(5)). But my point was that these protections don't extend to Australian data -- the location of the data is irrelevant to jurisdiction if you're talking about Australian data being stored by an Australian company.