New Zealand organisations are prioritising greater control over where critical data is stored and who can access it.
Confidence in resilience is outpacing preparedness, with many organisations lacking formal data governance and tested recovery plans.
AI adoption is accelerating the need for trusted data, stronger governance and resilient infrastructure.
New research from Datacom suggests New Zealand organisations are placing growing importance on where their data is stored, who controls it and how quickly it can be recovered during disruption.
The research found 72% of senior business and technology leaders consider ownership and control of data to be an important or critical priority for their organisation. Most (64%) said their most sensitive or business-critical data is stored in New Zealand, while a further 21% use a mix of local and offshore storage.
At the same time, concern about offshore data risks remains high, with 83% of leaders saying they were concerned about storing data offshore or with an overseas provider.
Data breaches were the leading concern, cited by 77% of those worried about offshore storage, followed by legal access by foreign governments (60%).
Despite these concerns, only 35% of organisations had a formal, written policy governing where critical data should reside and how those decisions are made, while more than half (55%) did not.
“CAIOs might not have a technical background, with the main elements of the job focused on transformation, communication and innovation, ensuring organisations understand the shifts that are happening and that where is a plan to move forward.”
Peter Nelson, Managing Director of Datacom New Zealand, says the findings point to a gap between awareness and operational readiness.
“Organisations are paying much closer attention to where their critical data sits, who controls the infrastructure it relies on and what would happen if access was disrupted. The challenge is turning that awareness into practical action. Resilience comes from having clear policies, tested recovery plans and a realistic understanding of how the business would respond during an outage or disruption.”
Eighty-five per cent of leaders were confident their organisation could continue operating critical services during a disruption to offshore cloud access, network connectivity or a cloud control plane.
Seventy-nine per cent also described their backup strategy as mature. However, only 41% had a documented exit or migration plan if their primary provider became unavailable or unacceptable, while just 39% had tested their ability to restore critical systems and data within the previous six months. Thirteen per cent had never tested their recovery capabilities.
The gap was particularly pronounced among smaller organisations. Seventy per cent of organisations with 20 or more employees had a formal policy governing where critical data is stored and managed, compared with just 7% of those employing fewer than 20 people.
Nelson says resilience needs to be tested, not assumed.
“A backup strategy is only as good as an organisation’s ability to restore from it when something goes wrong. Businesses need to know how quickly they can recover, whether critical systems will keep operating and what options they have if a provider or network route suddenly becomes unavailable.
“For New Zealanders, a major network outage can mean far more than a temporary inconvenience. It can affect how people access essential services, how businesses take payments, how supply chains operate and how communities stay connected during critical moments. These examples highlight why organisations need to be ready to respond quickly, minimise disruption and restore normal operations as soon as possible.”
Most respondents said their most sensitive or business-critical data was stored in New Zealand, with 64% using an entirely local approach and a further 21% using a mix of local and offshore storage.
Among organisations using local or hybrid storage, 56% said their data was hosted in data centres operated by hyperscale providers such as AWS, Microsoft Azure or Google.
More than half of leaders (56%) were concerned that foreign governments could access data stored in New Zealand when the underlying infrastructure was owned by a multinational provider.
While 72% said ownership and control of data was an important or critical priority, cost and scalability remained the biggest driver of storage decisions, cited by 39% of respondents. This compared with 16% driven primarily by regulatory or compliance requirements and 10% by considerations around jurisdiction and control.
Almost half of respondents (45%) said AI adoption had already influenced their data infrastructure and storage decisions over the past year.
At the same time, 43% said legacy systems, fragmented data platforms or unclear governance were slowing their ability to adopt AI safely.
Lou Compagnone, Director of AI at Datacom, says AI ambition is moving faster than data readiness in many organisations.
“Businesses are pushing ahead with new tools, but legacy systems, fragmented platforms and unclear governance are making it harder to adopt them safely and at scale.
“The organisations that get the most value from AI will be the ones that have done the foundational work first – trusted data, strong governance, clear access controls and confidence in where information is stored and who can access it.”
More than a third of leaders (37%) said their organisation was already reviewing its approach to where critical data is stored and managed or planned to begin a review within the next six months.
The research also found limited consideration of Te Tiriti o Waitangi and Māori data governance principles in data storage decisions. Only 27% of leaders said their organisation always or often considered these principles, while one-quarter said they were never considered.
Larger organisations were more likely to take Māori data governance into account, with 39% of organisations employing 20 or more people doing so always or often, compared with 18% of smaller organisations.
There was also strong support for keeping sensitive information under New Zealand jurisdiction, including financial data (63%), customer data (61%), employee data (58%), health data (57%) and intellectual property (56%).
Expectations were even higher for government-held information, with 75% believing citizen data should remain under New Zealand jurisdiction, followed by tax and financial records (71%) and defence and national security information (70%).
The findings suggest organisations are increasingly balancing cost, performance and scalability with a better understanding of where critical information is stored, who can access it and how quickly it can be recovered during disruption.
Datacom recommends organisations regularly review their data storage and governance settings, test recovery and exit plans, and assess whether their infrastructure can support business continuity, regulatory requirements and AI adoption.
