Privacy

Where your data lives, and why New Zealand businesses keep asking.

Sooner or later a client, a government agency or a European partner asks a New Zealand business the same question: where is our information actually held? It sounds like a technical question. It is usually a question about risk, responsibility and whether you know your own systems.

This article explains why the question comes up, what New Zealand's Privacy Act and the Privacy Commissioner's guidance say about using cloud services that operate overseas, the other rules that can bear on it, and how to give an answer that is accurate. It explains published guidance. It is not advice on your situation.

Why people ask

Most people asking are not expecting a single answer. Modern software runs on many services at once: one for documents, another for sign-in, another for email delivery, another for payments. Any of them can operate in a different country. The person asking wants to know that you have thought about it.

There are usually three concerns underneath. Whose laws apply to information held in another country, and could a foreign government compel access? Who is responsible if something goes wrong? And does the arrangement fit any rules the asker is bound by, such as an agency's cloud policy or a European partner's privacy obligations?

What the Privacy Act says about overseas cloud services

Information privacy principle 12, on disclosure outside New Zealand, came in with the current Privacy Act. The Privacy Commissioner's guidance says it requires businesses and organisations to make sure personal information transferred overseas is adequately protected, and that one way to do so is to have reasonable grounds to believe the recipient will protect it with safeguards comparable to New Zealand's.

Cloud services are often treated differently. The Commissioner's guidance explains that where a provider holds information on your behalf as your agent, the information is generally treated as held by you, and principle 12 may not apply because you have not disclosed it to anyone. The same guidance is clear about the consequence: you are responsible for the personal information you put in the cloud, not the cloud service provider.

So the practical question is not simply which country a service is in. It is whether the provider only holds and processes the information for you, what safeguards it applies, and whether you could show that you checked. Principle 5 still requires reasonable security safeguards, wherever the information sits.

Other rules that can bear on it

Tax records

Inland Revenue's record-keeping guidance says that if you store your records offshore, including through cloud computing, you or your cloud service provider should have its approval. That is specific to the records you keep for tax purposes, and it is worth checking for every system that serves as their permanent home.

Government work

The government's Cloud First policy, refreshed in April 2023, asks agencies to adopt public cloud case by case after a risk assessment, limits public cloud to information classified RESTRICTED or below, and prefers over time to host RESTRICTED information in a New Zealand based data centre where a suitable service exists. Suppliers handling agency information should expect questions shaped by that policy.

European partners

The European Commission decided in 2012 that New Zealand ensures an adequate level of protection for personal data and confirmed in its January 2024 review that it continues to do so. European partners sending personal information here may still ask where it goes next, because onward transfers need their own assessment.

How to answer well

List every service that holds or processes the information, not only the obvious one.
For each, note where it operates and what it does: storage, sign-in, email, payments, analytics.
Note whether each provider holds the information only on your behalf or also uses it for its own purposes.
Describe the safeguards around access: who can see what, how they sign in, what is recorded.
Point to each provider's privacy policy that lists the services it uses.

An accurate answer with the supporting services named is worth more than a short reassuring one. People who ask this question tend to check.

ShareAndGo's answer

We give the same answer to everyone who asks. Your documents are stored in Sydney, Australia.

Inside a room, access controls do the rest of the work: each person confirms their email with a six-digit code, groups see only the folders you allow, view-only documents are rendered on our side and never sent to the recipient's browser, and every action is recorded in a chained audit log you can export.

Questions people ask

Does the Privacy Act stop me using cloud services overseas?

No. The Privacy Commissioner's guidance explains that a provider holding information as your agent is generally treated as you holding it, and that you remain responsible for the personal information you put in the cloud. Principle 12 applies when personal information is disclosed overseas.

Where does ShareAndGo keep documents?

Your documents are stored in Sydney, Australia.

What should I check about a cloud provider?

Where each part of the service operates, whether the provider uses your information for its own purposes, what safeguards it applies and which other services it relies on.