What the term actually means
When your files sit on a server in Sydney, that server is in Australian jurisdiction. Courts and agencies there can, in some circumstances, compel the provider to hand over data. The same applies in the United States, where many software companies are based, and some laws can reach data held by those companies wherever it is stored. Your business is still bound by New Zealand law, so data stored offshore can be subject to more than one legal system at once. Data residency is the related idea of where data is physically stored. A vendor might store your data in Australia but be owned by a US company, so residency and sovereignty are not always the same question.
Where NZ business data usually lives
Most small businesses never chose a location; it came with the product. Large platforms commonly store NZ customers' data in Australian data centres, and some services store it in the United States or Europe. Microsoft and other major providers have been building data centre capacity in New Zealand, although not every service or every customer's data is necessarily held here, so check each product rather than assuming.
Smaller software vendors often host with one of the big cloud platforms and choose a region for all customers. Some NZ-built products host locally, which can suit businesses with strict client requirements. The answer varies product by product, which is why a list of where each system stores data is worth keeping.
What the Privacy Act 2020 expects
The Privacy Act does not ban storing personal information overseas. If a provider is only storing or processing data on your behalf, your business generally remains responsible for it, as if you held it yourself. If you disclose personal information to an overseas organisation for its own use, there are additional rules about whether that country or organisation offers comparable protection.
In practice that means choosing reputable providers, understanding their security, having appropriate agreements in place and being able to tell people where their information goes. The Office of the Privacy Commissioner publishes guidance on cloud services and cross-border disclosure; read it rather than relying on general summaries, including this one, for anything specific to your situation.
When location really matters
Some businesses have stricter obligations. Government agencies and their suppliers may have to follow government guidance on cloud use and data classification. Health providers have health information rules and sector expectations. Law firms, financial advisers and businesses holding Māori data may face client or community expectations about where data is kept and who governs it, sometimes written into contracts. If a contract or tender says data must stay in New Zealand, read exactly what it covers. Does it include backups, support access, email and AI features? Products can store primary data locally while processing some functions elsewhere, so get the vendor's answer in writing for each part.
How to check your own position
List every system holding personal or confidential information: email, file storage, accounting, payroll, CRM, practice or job management, backup and any AI tools. For each, record where data is stored, where backups are kept, the company's home country and whether support staff overseas can access it. Most vendors publish this in a trust or privacy centre; if not, ask. Compare that list with your contracts, insurance requirements and what your privacy statement tells customers. If your website says data is kept in New Zealand and your CRM is hosted in the United States, change one or the other.
Practical choices
For most offices the sensible course is to use reputable providers, prefer the closest region when there is a choice, enable strong sign-in security and encryption, and document the arrangement. Where clients require local storage, choose products that offer it and confirm backups and support follow the same rule. Keeping the record current matters more than finding a perfect answer, because clients and insurers increasingly ask, and a clear one-page summary answers them quickly.
Review the record whenever you add a new system or a vendor announces a change, such as a new hosting region or an AI feature that sends data to another provider. Vendors do sometimes move data between regions, usually with notice in an email that is easy to miss. A yearly check against each vendor's published data location page keeps your summary accurate without much effort.
In short
- Data stored offshore can be subject to that country's laws as well as New Zealand's.
- The Privacy Act 2020 allows offshore storage, but you stay responsible for the data.
- Check location for primary data, backups, support access and AI features separately.
- Keep a one-page record of where each system stores data and review it yearly.