Do you have a question? Want to learn more about our products and solutions, the latest career opportunities, or our events? We're here to help. Get in touch with us.
Across Australia and New Zealand, organisations moved workloads out of on-premises server rooms, data centres, and co-located facilities, gaining scalability and access to new services in the process. Then the push to modernise platforms and applications began in earnest.
That work remains vital. But business leaders are asking a tough new set of questions. Which systems are indispensable to serving customers, citizens and communities? What happens if a cyber incident, connectivity outage or geopolitical event cuts access to an offshore dependency? Who has legal and operational control over critical data and infrastructure? And can the organisation recover quickly enough to keep operating?
To explore how these questions are reshaping cloud and infrastructure decisions, we spoke with Mike Walls, Director of Cloud and AI Infrastructure at Datacom.
Not on its own. Organisations increasingly need a broader digital infrastructure strategy, one that includes public cloud, private cloud, sovereign infrastructure, edge environments and the connections between them.
Cloud remains a major component, but it is no longer the whole picture. Most organisations have already made initial cloud decisions as part of migration and digital transformation projects. The next phase is about understanding whether workloads are in the right place, whether the architecture supports digital outcomes, resilience, and whether the operating model is delivering the expected value.
That means starting with the business, not the technology. Every organisation now relies on digital systems to transact, communicate, deliver services and maintain customer relationships. The strategic question is: which digital capabilities must remain available for us to operate?
Once that is clear, the organisation can make better choices about where systems should run, how they should be protected and what recovery options are needed.
Sovereignty is often reduced to a simple question: “Is our data stored in New Zealand or Australia?” That is data residency. It matters, but it is not the same thing as sovereignty.
A more complete definition includes:
In other words, sovereignty is fundamentally about control and resilience. Local data storage may reduce some risks, but it does not automatically ensure full control over the data or the services that make that data accessible or usable.
For example, an organisation may use a local region of a global cloud platform, which in turn relies on offshore identity services, control planes or AI services. If connectivity to those offshore elements is disrupted, local data alone may not be enough to keep the business running.
Three forces are bringing the issue into focus: geopolitical uncertainty, cyber risk, and growing dependence on AI and digital infrastructure.
Organisations are becoming more aware that critical services can be disrupted in ways that have little to do with their own technology teams and systems. International connectivity can fail. Supply chains can be constrained. Cyber attacks can lock organisations out of their systems. Legal requirements can change, while offshore jurisdictions may create obligations or access rights that local customers do not fully understand.
The result is a shift from a compliance-led conversation to a resilience-led one.
For regulated organisations, sovereignty may be tied to specific requirements around privacy, critical infrastructure or financial resilience. But the issue now extends well beyond regulated sectors. If customers can only buy, transact, book, communicate or receive services through digital channels, loss of access to those systems is a business continuity problem, regardless of the industry. If those systems hold intellectual property or drive local economy what is the risk of losing control?
AI makes data governance more complex because sensitive information can enter the system at multiple points: prompts, retrieval-augmented generation (RAG) data, fine-tuning data, model outputs and logs. When you consider AI systems now hold your intellectual property and run critical business processes you can understand why boards and execs are concerned about risk.
Organisations should apply the same discipline they use for critical infrastructure. They need to understand the data, classify its sensitivity and determine the legal, regulatory, economic and cultural obligations attached to it. Then assess where the AI service runs, where inference takes place, how data is retained and who can access it.
A locally hosted cloud region does not necessarily mean that every AI capability is local. Some services may process data offshore, and inference may be routed outside the region. With seen an increase in models being retracted raising supply chain issues. Organisations need to understand those pathways before using AI with sensitive or strategically important information.
A lesser discussed topic is that AI raises further questions about whether models reflect local values, cultural context and appropriate governance of taonga data for example.
No. Public cloud remains an important source of capability, scale and innovation.
The better approach is to assess business services and workloads individually. Start by identifying the systems that are essential to delivering core services, then consider the consequences if they become unavailable or control of data is lost.
Plenty of workloads may be well suited to global public cloud services. Others may require local production environments, sovereign backups, a locally recoverable replica, or stronger controls around data access and jurisdiction. In some cases, the right answer may be a hybrid architecture: public cloud for day-to-day operations, with a sovereign recovery environment available if access is disrupted. Others might point to critical services needing to be fully sovereign.
The point is to design for the risk profile of each workload, rather than impose a single hosting model across the entire estate.
Start with business impact.
If this system became unavailable tomorrow, what would happen? Could you still serve customers or citizens? Could staff continue operating? How long could you tolerate an outage? What data would be exposed or inaccessible? Would you breach a contractual, regulatory, or cultural obligation? What is the impact to intellectual property and to economic resilience?
That assessment helps separate systems that are important from systems that are truly critical. It also makes the conversation more practical. A customer-facing e-commerce platform, identity service, or core financial system may need a very different resilience and sovereignty design from a collaboration tool or productivity application.
The next step is mapping dependencies and supply chain. A workload may appear to run locally, but everyone in the company may need to authenticate their identity via a system or backplane sitting in Singapore or the US. Understanding those dependencies is essential, because they often determine whether a service can acontinue operating during a disruption.
The most common misconception is that local data residency equals sovereignty.
A local cloud region can improve performance, support local data storage and help meet some compliance requirements. But organisations should look beyond the location of their data.
They should ask whether the provider is subject to overseas legal jurisdiction, whether support and operational access can be exercised from offshore, and whether key platform functions remain dependent on systems outside Australia or New Zealand.
This is why sovereignty needs to be assessed across the full stack: data, infrastructure, platform services, identity, operations, support and recovery.
A sovereign backup is a key resilience measure, particularly for organisations that use global cloud or software-as-a-service platforms.
In practical terms, it means maintaining a recoverable copy of critical data in a locally hosted and locally controlled environment. That can give an organisation an option to restore systems or data if its primary provider becomes unavailable, suffers a cyber incident, or is otherwise inaccessible.
Sovereign backup and immutable backup solve different but complementary problems.
A sovereign backup focuses on where the data is held, who controls it, and whether it can support local recovery. An immutable backup protects data from being altered, encrypted, or deleted, even if an attacker gains access to production systems.
For critical workloads, organisations should consider both – a local, sovereign copy that is also immutable. That combination improves the chances of recovering clean data and restoring operations under local control.
Not necessarily. Multicloud can reduce concentration risk, but it also introduces complexity, cost and operational overhead. A multicloud strategy that emerges accidentally, through separate projects, acquisitions or business-unit decisions, can create more friction than resilience.
For smaller organisations especially, running multiple cloud platforms may not be economically justified. A well-designed single-cloud environment, paired with strong backup, recovery and local resilience measures, may offer a better balance of cost and risk.
The important distinction is between multiple providers and genuine recoverability. Using two cloud platforms does not automatically mean an organisation can fail over quickly. That depends on architecture, data replication, application portability, tested recovery procedures and the skills to operate the environment under pressure.
It also doesn't necessarily answer sovereignty questions, unless one of those cloud providers is truly sovereign.
For many organisations, the most pragmatic path is to use the cloud platform that best supports their needs while preserving an independent, sovereign infrastructure or recovery option for their most important systems and data.
The most useful question is one of the simplest: Which digital capabilities must remain under our control for us to continue serving customers, citizens and communities?
It moves leaders beyond generic cloud and infrastructure preferences and towards a clear view of the systems that underpin the organisation’s ability to function successfully.
From there, boards and executive teams can ask:
Sovereignty should not be treated as a barrier to innovation. It is a way to be more deliberate about where innovation happens, what must remain under local control, and how the organisation stays resilient when conditions change.
As cloud estates become more complex, organisations need confidence in how critical systems are designed, managed and recovered. Datacom helps businesses assess cloud environments, optimise workloads and develop cloud strategies that support performance, governance and resilience across hybrid and multi cloud environments.
