Where is your Microsoft 365 data stored? Notes for NZ businesses

Checking where your data actually is

Sign in to the Microsoft 365 admin centre and look under the organisation's settings for the data location section of the organisation profile. It lists where each main service, such as Exchange Online, SharePoint and Teams, stores your data at rest. Take a screenshot and keep it with your privacy records so you can answer the question quickly when a client or insurer asks.

Data location is set when a tenant is created, based on the country chosen at sign-up and what Microsoft offered at that time. Many NZ businesses that signed up before local datacentres existed have their data in Australia. Some services, such as certain AI features, support services or optional add-ons, may process data in other regions, and Microsoft documents those exceptions.

What changed with local datacentres

Microsoft has opened a cloud region in New Zealand, and has said that Microsoft 365 customer data for eligible NZ tenants can be stored in-country. New tenants created with a New Zealand address are generally provisioned there for supported services. Existing tenants may be able to request a move through Microsoft's data residency programmes, depending on timing, eligibility and licensing.

These programmes and their rules change, so check Microsoft's current documentation rather than relying on anything written a year ago. If local storage matters to your business, ask specifically which services are covered, whether a move is available for your tenant, what it costs and how long it would take. Get the answers in writing for your records.

Does it legally matter?

For most private NZ businesses, there is no general law requiring data to be stored in New Zealand. The Privacy Act 2020 does set rules about sending personal information overseas, but when a cloud provider stores or processes information only on your behalf, that is generally treated as you still holding it, rather than a disclosure to a third party. You remain responsible for it being protected.

That responsibility is the important part. You need reasonable security safeguards, the ability to respond to people asking for their information and a plan for privacy breaches. Some sectors and some government contracts have their own requirements or preferences, so health providers, schools and businesses working for public agencies should check the rules that apply to them specifically.

Client and contract expectations

Even where the law does not require local storage, clients sometimes do. Larger organisations and government agencies may ask suppliers where data is held, who can access it and how it is protected. Tender documents increasingly include security and data location questions. Having a clear, accurate answer ready makes those conversations easy and shows you have thought about it.

Be precise. Saying all our data is in New Zealand when mailboxes are in Australia and backups go to the United States is worse than an honest, documented answer. Map out where each piece lives: Microsoft 365 core data, your backup provider's storage, your accounting system, your CRM and any file transfer tools staff use.

Backups and other services

Data residency questions apply to every copy, not only the original. A Microsoft 365 backup service stores copies in its own datacentres, which may be in New Zealand, Australia or elsewhere depending on the provider and the plan. Many offer a choice of region at setup. Check this before signing up, because moving backup data later can be difficult.

The same goes for other cloud tools connected to Microsoft 365, such as e-signature, email filtering, practice management or CRM systems. Some copy mailbox or file data to their own servers. Keep a simple register of each system, what personal information it holds and where it is stored. It takes an afternoon and helps with privacy requests, breaches and supplier reviews.

Practical steps for most businesses

Check your tenant's data location and record it. Ask your backup provider where your backups are stored. Build the simple register of systems and locations. If clients or contracts require local storage, look into Microsoft's current residency options for your tenant and plan any move properly, because it can take time and may have licensing implications.

Then focus effort where it reduces real risk. Strong sign-in security, sensible sharing settings and good backups protect personal information far more than its exact location does. A breach caused by a stolen password is just as serious whether the data sat in Auckland or Sydney, and those controls are entirely within your hands.