Data sovereignty in New Zealand

When an organisation stores its data with an overseas cloud provider, the laws of the country where that data sits apply in addition to New Zealand law.

The data owner remains responsible for making sure the data is handled in a way that complies with all applicable laws, including New Zealand's own privacy legislation. It is not the cloud provider’s responsibility.

This leaves data owners with a practical problem. A government or court in the host country can compel a cloud provider to hand over data, often without notifying the data owner. Sometimes under legal orders that may not require judicial warrants in the New Zealand sense

US law can apply to data kept in New Zealand

US law extends this further. Under America’s Cloud Act, that nation’s authorities can demand access to data held by US-owned companies even when that data is physically stored in another country.

It could mean your private information is readily available to US government agencies.

Which is why data sovereignty is so important. It is the principle that data should remain subject to the laws of the country where it was created or where the people it concerns are based: not wherever a cloud provider happens to store it.

In the past, people believed the best way to ensure data remains private and protected was for it to never leave this country, but in today’s world of cloud computing, international data centres and AI scraping, that’s increasingly difficult.

Local cloud

You may hear service providers talk about ‘local cloud’. The implication is that data stays in New Zealand and any services are operated here. The service providers argue this reduces exposure to offshore risk and aligns with local privacy expectations.

While this can be the case, if the provider is a foreign company, then it may still be subject to overseas law.

The term ‘local cloud’ muddies the waters. The key distinction is not where data lives. Nor is about where services are billed or even if the service provider is local when it resells from a hyperscaler.

What matters is which country’s courts can compel access and which country’s regulator has authority over processing. You need to consider what happens if there is a cross-border legal request. Also, it matters who controls encryption keys and administrative access.

In New Zealand, data sovereignty is not defined by a single rule or policy. It emerges from the interaction of three overlapping layers. They do not always point in the same direction.

Privacy Act 2020

New Zealand’s Privacy Act 2020 is central. It governs how personal information must be managed in New Zealand. It requires organisations to protect personal data and to limit its disclosure overseas. It also sets expectations for transparency, purpose and security. In serious cases, the Act mandates breach reporting.

There’s nothing in the Act that prevents data from being processed overseas and the Adt neither removes exposure to foreign legal systems nor asserts exclusive New Zealand jurisdiction over data once it leaves organisational control.

Foreign laws and operational control

The second layer comes from foreign laws with extraterritorial reach, most notably the US Cloud Act.

Data stored in New Zealand can still fall within overseas legal jurisdiction if the service provider is headquartered elsewhere or subject to another country’s laws.

Operational control

The third layer is less about law and more about operational control and strategic dependence.

This includes who owns the infrastructure, who operates the cloud platform, where management decisions are made and whether New Zealand organisations can meaningfully control access to their own data and systems.

Hyperscalers and local regions

A foreign cloud provider can build a local data centre region in New Zealand. Local customers get the benefit of lower latency. Providers argue that it improves resilience. Yet it does not automatically create sovereign control. The infrastructure may sit in Auckland, yet ownership, software control, support operations and legal accountability remain offshore.

There’s a clear tension here. Hyperscalers can offer lower costs and greater capability, but that can come at the cost of accountability and alignment with New Zealand interests. There are also national security questions. What happens during geopolitical conflicts? Will we always be able to access that data?

Expensive litigation

If a dispute arises over data handled by an overseas provider, any legal action is likely to take place in a foreign court under unfamiliar rules.

For a New Zealand organisation, that means not just legal fees but the cost of navigating an foreign system, but potentially losing any savings that motivated the offshore decision in the first place.

Māori data sovereignty

There’s a unique New Zealand Aotearoa aspect to data sovereignty: Māori data sovereignty. This holds that data about Māori people, communities and whenua should be subject to Māori governance — not simply New Zealand law in general.

The principle draws on tino rangatiratanga, the right of self-determination affirmed in Te Tiriti o Waitangi. Te Mana Raraunga, the Māori Data Sovereignty Network, has been central to developing this framework.

The concern extends beyond offshore jurisdiction: even data held within New Zealand may not be under Māori control if it sits with a government agency or commercial provider without appropriate governance arrangements.

It’s not about the technology

Data sovereignty is often viewed as a technical problem with a technical solution. In reality it is a question of accountability: who has the right to access information, under what rules and in whose interests.

For New Zealand organisations, the answer increasingly depends less on where data is stored and more on whose law governs it, who controls the infrastructure and whether those arrangements can be trusted to hold when they are tested.

This page is part of a series of background briefings on New Zealand’s telecommunications industry:

• Fibre networks in New Zealand
• Mobile networks in New Zealand
• Satellite communications in New Zealand
• Rural telecommunications in New Zealand