| Data sovereignty concerns the laws and legal powers that can apply to your information. Data residency describes where it is stored. A New Zealand data centre can help meet a location requirement, but the legal entities, operations and control of the provider can expose information to other jurisdictions too, and more than one country’s law may apply. |
Here is a hypothetical. A customer sends a two-page schedule with a supplier panel renewal. It asks which countries hold your data, which companies can reach it, and what happens if one of them receives a legal order.
The schedule gets answered from memory because that is quicker. One answer turns out to be wrong: a document system everyone assumed was in Auckland stores its files offshore. Nobody meant to mislead anyone; nobody had checked.
The better start is to document where each important service stores and processes information, which organisations can access it, and what the relevant contracts require. Use that record to decide which risks need technical changes, supplier clarification or legal advice.
Where servers ought to live is an architecture question, and our guide to hybrid cloud covers it. The wider set of privacy duties belongs to our guide to Privacy Act compliance, which covers the privacy principles in full.
Why Does Data Sovereignty Matter for a New Zealand Business?
Data sovereignty matters because the law reaching your information is not only New Zealand law, and customers, insurers and agencies have started asking which laws apply.
For many owners the question arrives as paperwork. A procurement schedule wants a list of countries, an insurance renewal asks whether customer information is held offshore, and a customer asks where their file has been kept. Each one is answered from contracts, supplier documentation and settings pages, not from memory.
A customer’s right to direct that their own data be handed to somebody else now has a statute behind it in one sector, and what the Customer and Product Data Act lets a bank customer do shows where that right is heading.
What is the difference between data sovereignty and data residency?
Data residency describes where stored information sits, such as a named cloud region. Data sovereignty describes the legal authority that can reach the same information. Storage, processing, access, the contracting entity, parent companies and subprocessors can all matter, so ownership alone does not settle it.
The United States Clarifying Lawful Overseas Use of Data Act, shortened to the CLOUD Act, is the example businesses meet first. The US Department of Justice explains that providers subject to US jurisdiction may have to produce information within their possession, custody or control through applicable lawful process, including information held overseas. That is not automatic access to every file held by an American brand, and whether a subsidiary is covered depends on the facts.
Is this the same as Māori data sovereignty?
No. This guide focuses on commercial hosting and legal jurisdiction decisions. Māori data sovereignty also concerns collective rights and interests in the collection, ownership, governance and use of Māori data, as set out in the principles of Te Mana Raraunga.
Where Māori data is involved, involve the appropriate Māori stakeholders rather than treating hosting location as the whole issue.
Who asks a New Zealand business about data sovereignty?
Corporate customers, government agencies buying services, insurers at renewal, and individuals using their privacy rights. The wording changes with the sender, and the request underneath is similar: name the countries and the organisations involved, and explain what happens when one of them receives a legal request.
Write the answer down once and keep it with the contracts. The person asked next time may not be the person who worked it out.
What Does the Privacy Act 2020 Say About Sending Information Overseas?
The Privacy Act concerns personal information, not every category of business data. A New Zealand agency keeps its responsibilities when it uses offshore services, and the supplier can have responsibilities of its own, including an overseas agency that carries on business in New Zealand.
The Act has a principle aimed at cross-border disclosure: information privacy principle 12, written as IPP 12. It is narrower than it first appears.
Does IPP 12 apply to a cloud provider?
Not when the provider acts solely as your agent. Section 11 treats information a provider holds only for safe custody or processing on your behalf as held by your business, wherever the provider is. Offshore storage through that arrangement is not, by itself, a disclosure governed by IPP 12.
Other privacy duties still apply, including suitable security safeguards and oversight of the supplier.
When does a cloud service become a disclosure under IPP 12?
When the provider uses the information for its own purposes, both organisations may be treated as holding it and a disclosure may occur. An offshore bookkeeper working your ledger is not automatically an own-purpose recipient, and an overseas parent receiving a client list also needs a role and purpose assessment.
IPP 12 includes several routes. Depending on the facts, the recipient may be subject to the New Zealand Act through carrying on business here, subject to comparable privacy law, or bound to comparable safeguards through an agreement. Express authorisation after an appropriate warning is another route, and IPP 11 must still permit the disclosure.
The Act also provides for prescribed countries and binding schemes, but none have currently been prescribed. The Privacy Commissioner publishes model contract clauses as one optional route where a contractual safeguard suits.
Do you need a contract with your cloud provider?
If the provider acts only as your agent, IPP 12 may not apply to the offshore storage arrangement. You still need appropriate safeguards and supplier terms covering security, access, subprocessors, locations, notification, return and deletion of information. If information is disclosed to an overseas recipient, assess IPP 11 and IPP 12 and identify the applicable safeguard.
Which of Your Business Systems Store Data Outside New Zealand?
A data sovereignty register answers that. Do not infer a location from the brand of the vendor or its headquarters; record verified facts for the actual product, tenant and service plan.
Start the list with these:
- Email and files. Microsoft 365, Google Workspace or another platform
- Accounting. The package and anything connected to it
- Payroll. Which holds bank account and IRD numbers
- Customer systems. Practice, job or customer management software
- Backup. Which can sit in a different country from the system it protects
- Phones. The phone system and any call recordings
- Website. The host and every form on it
- Staff purchases. Subscriptions bought on a company card, covered in our guide to managing software subscriptions
For each system, record more than a country:
| Record | What to capture |
|---|---|
| Service and information | Workload, accountable owner, data types, sensitivity and relevant requirements |
| Organisations | Contracting entity, operators, relevant parents and subprocessors |
| Locations and access | Production, backups, logs, processing and support access, with country and scope |
| Control and terms | Access and key control, request handling, change notices, exit and deletion terms |
| Verification and action | Source, date, current or committed status, unknowns, next action and review trigger |
Unknown means clarification is needed, not automatically offshore or non-compliant. Review the high-impact systems first, and update the register after material supplier, contract or system changes as well as at periodic reviews.
How do you find out where a system stores your data?
Read the supplier documentation, then ask in writing for anything it does not answer and set a follow-up date. Keep each answer with its source and date.
For Microsoft 365, open Settings, Org settings, Organization profile, Data location in the admin centre, then check the current and committed location for each relevant workload. New Zealand is a Microsoft local region geography, and Advanced Data Residency is an additional offering with tenant, licensing and purchase conditions, not a setting that moves every existing tenant. A New Zealand billing address, an Azure region or one workload’s location does not prove where the whole tenant sits.
What about backups, logs and support access?
Confirm them separately. At-rest residency commitments do not establish that every log, processing activity or support interaction stays in one country, and a backup service has its own storage, processing and access arrangements. Our Microsoft 365 backup guide covers that service, and its arrangements are checked separately from the commitments Microsoft makes.
Does Storing Data in New Zealand Settle Data Sovereignty?
No. New Zealand storage can help with latency or a specified location requirement, but it does not settle every jurisdiction question. The Cloud Jurisdictional Risk guidance notes that jurisdictional risk can remain in onshore data centres where the services are owned or operated by offshore vendors.
A locally owned provider with no foreign parent does not ensure that only New Zealand law can reach the information either. Foreign operations, subprocessors and possession or control still need assessment.
What is a New Zealand data centre worth?
It can meet a contractual location requirement and reduce latency. It does not automatically satisfy security, privacy, procurement or every customer condition, so check the actual clause, service scope and exceptions before recommending a migration.
Some facilities and areas hold Public Cloud Data Centre Certification from the Government Digital Delivery Agency. Certification covers a facility or a defined area against government security requirements; it is not approval of every hosted application and does not remove jurisdictional risk. Check the register and the exact certified scope.
What Should You Ask a Cloud Provider About Data Sovereignty?
Ask in writing and keep the answers filed with the contract:
- Locations. Where production data, backups and logs are held, and where processing and support access occur
- Organisations. Which entity sells the service, which parents are relevant and which subprocessors are involved
- Legal requests. Who reviews a request, whether disclosure is limited to what is required, and whether you will be told unless notice is legally prohibited
- Changes. How you are notified of new locations or subprocessors
- Exit. What you receive back, in what format and timeframe, and how remaining information is deleted
A provider with a written process for legal requests can describe it. A vague answer is a reason to ask again, not a finding on its own.
When Does Business Data Have to Stay in New Zealand?
There is no single onshore rule for all business data. Requirements depend on the records, the sector and the contract.
- Tax records. Storing business records offshore needs Inland Revenue approval, which can be held by the taxpayer or by an approved provider
- Government work. The Cloud First policy restricts public cloud data to RESTRICTED or below and says agencies should move RESTRICTED information onshore over time where a suitable service exists
- Sector rules. Health and financial services arrangements can carry their own conditions
- Customer contracts. A corporate customer can require locations or notices through its supplier terms
A contract creates obligations between its parties. Whether a subcontractor inherits a hosting rule depends on the terms it agreed and any applicable requirements, and an agreement cannot simply override a public-law power. The Cloud First policy applies to government agencies; a private supplier checks its actual contract rather than assuming every system must move.
What Affects the Cost of Sorting Out Data Sovereignty?
Cost depends on the number of services, the documentation available, contract review and any technical changes. Product count and supplier responsiveness matter more than headcount.
- Inventory. The number of systems and how well they are already documented
- Supplier review. How many written questions are needed and how quickly suppliers answer
- Contract review. Legal advice where a jurisdiction or contract question needs it, arranged separately
- Technical changes. Migration or configuration work, scoped and quoted on its own
- Ongoing updates. Keeping the register current after supplier, contract or system changes
Released staff time is capacity rather than a cash saving, and retiring a system only saves money once migration, retention, exit and control needs are met. A separate backup is a resilience control, not avoidable duplication.
Where Should a Business Start With Data Sovereignty?
Start with the list, because nothing else can be decided until you know what you have.
List the systems
List every system holding customer or staff information, including subscriptions bought on a card.
Record the facts
For each one, record locations, organisations, access and terms, with the source and date.
Mark high-impact systems
Identify the systems holding sensitive information or subject to specific requirements.
Ask the suppliers
Put written questions to the suppliers behind those systems and set a follow-up date.
Decide the action
Decide what needs a technical change, a supplier clarification or legal advice, and record the reasoning.
Keep it current
Date the register and review it after material changes as well as on a regular cycle.
Get Help With Where Your Data Is Held
Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide. Through our cloud solutions and IT consulting services, we help document where your systems hold information, clarify supplier answers and assess technical options.
NEXT STEP
Need a clearer record of where your business data is held?
Talk to Exodesk about a scoped system and supplier review. We help document the current position, follow up open supplier questions and assess technical options, with the scope agreed before work starts.
Or read more about our cloud solutions and IT consulting.
Frequently Asked Questions
What is data sovereignty?
Data sovereignty concerns the laws and legal powers that can apply to information. Data residency describes where it is stored. Location, the legal entities and operations of the provider, and who possesses or controls the information can affect jurisdiction, and more than one country can be involved.
Does the Privacy Act 2020 apply if my business data is stored overseas?
Your responsibilities for personal information continue when you use offshore services. The role and purposes of the provider matter, and it may also have privacy responsibilities. Check safeguards, supplier terms and whether the arrangement involves a disclosure to an overseas recipient.
What is information privacy principle 12?
IPP 12 sets conditions for disclosing personal information to overseas recipients. Safeguards can include coverage by the New Zealand Act, comparable overseas law or an agreement providing comparable protections, and express informed authorisation is another route. No countries or binding schemes are currently prescribed, and IPP 11 must also permit the disclosure.
Do I need a contract with my cloud provider to comply with IPP 12?
You may not need IPP 12 model clauses if the provider acts solely as your agent for storage or processing. You still need appropriate supplier terms and safeguards. If the arrangement is an overseas disclosure, assess the applicable IPP 12 route, and the model clauses can help where a contractual safeguard is appropriate.
Is Microsoft 365 customer data stored in New Zealand?
It can be, but the answer depends on your tenant, workloads and commitments. Check the Data location information in the admin centre and the relevant service terms. Advanced Data Residency has eligibility and licensing conditions, and backups, logs, processing and support access need confirming separately.
Does using a New Zealand data centre put your data beyond foreign law?
No. New Zealand storage does not settle every jurisdiction question. Check the legal entities, operations and subprocessors of the provider and who controls the information. A New Zealand owned provider with no offshore parent does not rule out foreign legal reach.
How long does it take to work out where business data is held?
A first inventory can be quick, but verification depends on the systems, supplier documentation and questions that remain unanswered. Record the source and date for each answer, identify unknowns and agree follow-up dates. Confirm the important workloads before making commitments to customers.
Does the New Zealand government have rules about storing data offshore?
Yes. The Cloud First policy restricts public cloud data to RESTRICTED or below and says agencies should move RESTRICTED information onshore over time where a suitable service exists. Risk assessments and other requirements still apply. For a private supplier, check the actual contract and applicable rules.
Does New Zealand law require business data to be kept onshore?
There is no single onshore rule for all business data. Requirements depend on the records, sector and contract. For example, storing tax records offshore needs Inland Revenue approval held by you or your provider, and privacy and customer requirements also need checking.
What does data sovereignty cost a small business to sort out?
Cost depends on the number of services, available documentation, contract review and any technical changes. Start with a scoped inventory and supplier review. Price migration, ongoing updates and specialist legal advice separately, and do not assume every business needs a new hosting platform.
What should I ask a software vendor about data sovereignty?
Ask where production data, backups and logs are held, where processing and support access occur, which entities and subprocessors are involved, how lawful requests and change notices are handled, and how information is returned or deleted on exit. Keep written answers with the contract and record their scope and date.
Does Exodesk work with Christchurch and Dunedin businesses on where their data is held?
Yes. Our Christchurch and Dunedin teams work with businesses across New Zealand. We can help build a system register, clarify supplier information and assess technical options. Any migration or ongoing review is scoped separately, with legal advice where a jurisdiction or contract question needs it.
Contact us or call 0800 396 337 to talk about a review of your systems and suppliers.
