Why New Zealand's data posture is falling short

• Data control is now a board-level issue. While 83% of organisations are concerned about offshore data risks and 72% say data ownership and control is a critical priority, many have yet to formalise the policies and governance needed to support those goals. 
  
  
• Confidence is outpacing readiness. Most leaders believe their organisations could continue operating through a major disruption, but relatively few have recently tested disaster recovery capabilities or developed documented plans for provider outages and data migration.
   
• Organisations need a more deliberate approach to resilience. From data sovereignty policies and recovery testing to local backup strategies and Māori data governance, leaders are being challenged to turn growing awareness into practical action. 

New Zealand organisations are paying much closer attention to data control, but many have yet to turn that concern into practical action.  

Datacom's recent data and digital resilience research – based on a survey of 155 senior business and technology leaders – found 83% of New Zealand organisations are concerned about offshore data risks, while 72% say ownership and control of data is an important or critical priority. Yet only 35% have a formal policy governing where critical data should be stored and managed, and less than half have a documented exit or migration plan if a provider becomes unavailable.   

That gap between awareness and preparedness needs to be addressed because as organisations become increasingly dependent on digital systems, cloud platforms and AI-enabled services, data resilience is no longer an IT issue, it is a business continuity issue.   

For executive teams and boards, the key question is simple: could your organisation continue serving customers, supporting staff and operating critical services if a key platform, network connection or provider suddenly became unavailable?  

One of the more striking findings from our research is that while 85% of leaders are confident they could continue operating critical services if offshore cloud access was disrupted, only 39% have tested their disaster recovery capabilities within the past six months, while 13% say they have never tested them at all.

Our research also showed the majority of organisations (64%) store their most sensitive data onshore, often with hyperscale providers (56%), but more than half worry foreign governments could still access it, a valid concern given legislation such as the US CLOUD Act could give US authorities a pathway to access data held by US‑headquartered providers, regardless of where the servers sit physically.

That does not mean organisations should avoid global cloud providers. Platforms such as AWS, Microsoft Azure and Google Cloud play a vital role in helping New Zealand organisations innovate, scale and compete. The important thing is understanding the dependencies that come with those decisions and making deliberate choices about critical systems and data.    

Regulatory changes are starting to force additional action on data resilience and sovereignty. Australian Prime Minister Anthony Albanese recently signalled expectations that critical infrastructure entities should be able to operate for up to three months without access to the internet.   

That is a bold call, but a logical one if you accept that digital systems are now as central to national resilience as bridges, power lines and hospitals. New Zealand will not be able to ignore these trends. Directors here are already facing higher expectations around cyber risk and data breaches, including potential financial and criminal liabilities, and that pressure will only grow.

Here is what I’d encourage New Zealand organisations to do over the next 12–24 months:  

Treat decisions about data as part of your business continuity, risk and ESG frameworks, not simply a technical configuration choice.  

Develop a formal data residency and sovereignty policy that covers where different data types can be stored and processed, which jurisdictions are acceptable, how decisions are made, and how trade‑offs are handled. Then use it in procurement and architecture decisions.  

Test your worst‑day scenarios by regularly rehearsing cyber-attacks, cloud outages and network disruptions. Include senior leaders and boards and test your ability to operate for weeks without key services and learn from those exercises.  

For your most critical data sets – customer, financial, employee, intellectual property – consider immutable backups and clean‑room recovery environments hosted within New Zealand, isolated from the internet. These capabilities can be delivered via private cloud or sovereign providers and form a crucial safety net.  

Optimise AI workloads and make deliberate decisions about which workloads can remain on global platforms where their capabilities are unmatched, and which can be brought onto local infrastructure for cost and control. Take advantage of GPU‑as‑a‑service and local hosting where it makes sense.  

Take Māori data governance seriously (only 27% of leaders say their organisation always or often considers Te Tiriti o Waitangi and Māori data governance principles in data storage decisions). Move from statements of intent to concrete practice, co‑designing governance frameworks and technical architectures that reflect Māori values and rights.  

The encouraging message from this survey is that New Zealand leaders are no longer shrugging off data resilience and sovereignty. The concern is there, the awareness is growing, and many are beginning to re‑examine their posture, but the uncomfortable truth is that concern alone won’t keep services running.