Published on the 06/08/2026 | Written by Heather Wright

Sovereignty fears rise, governance and preparedness trails…

Most New Zealand organisations are worried about offshore data risks, but many have not formalised how they would respond if access to those systems was disrupted – and few have formal policies governing where critical data is stored according to new research.

The Talbot Mills research, conducted for Datacom, found 83 percent of senior business and tech leaders surveyed are concerned about storing data offshore or with an overseas provider, while 72 percent consider ownership and control of data an important or critical priority for their organisation. Yet despite those concerns, only 35 percent have a formal written policy governing where critical data should reside and how those decisions are made and just 41 percent have a documented exit or migration plan if their primary provider becomes unavailable or unacceptable.

“More than half were concerned foreign governments could gain access to data stored in New Zealand if the underlying infrastructure was owned by a multinational.”

The findings come as organisations across New Zealand and Australia face growing scrutiny of data governance, cybersecurity and operational resilience.

Peter Nelson, Datacom New Zealand managing director, says are paying closer attention to how and where information is managed.

“Organisations are paying much closer attention to where their critical data sits, who controls the infrastructure it relies on and what would happen if access was disrupted,” he says.

The challenge, however, is turning that awareness into practical action.

According to the survey, concerns around offshore storage extend beyond questions of location. Among respondents worried about offshore data, 77 percent cited data breaches as a concern, while 60 percent were worried about legal access by foreign governments. More than half were also concerned foreign governments could gain access to data stored in New Zealand if the underlying infrastructure was owned by a multinational provider.

At the same time, most organisations are already keeping critical information close to home. The survey found 64 percent store their most sensitive or business-critical data entirely in New Zealand, while a further 21 percent use a combination of local and offshore storage.

The survey also highlights the difference between data residency and data control, an issue increasingly discussed in regulatory and governance circles on both sides of the Tasman. Australian governance and sovereignty commentary has increasingly focused on questions of who controls data and which jurisdictions can claim legal access to it, rather than simply where data is physically hosted.

Among organisations using local or hybrid storage models, 56 percent said their data is hosted in facilities operated by hyperscale cloud providers including AWS, Microsoft Azure and Google.

Governance lags

While concern about sovereignty is widespread, formal governance appears less common, particularly among smaller businesses.

The report found 70 percent of organisations with 20 or more employees have a formal policy governing where critical data is stored and managed. Among organisations with fewer than 20 staff, just seven percent reported having such a policy.

The survey suggests a similar gap may exist between confidence and preparedness.

Eighty-five percent of respondents said they were confident their organisation could continue operating critical services during a disruption to offshore cloud access, network connectivity or a cloud control plane. However, only 41 percent had a documented exit or migration plan if their primary provider became unavailable or unacceptable and just 39 percent had tested restoration of critical systems and data within the previous six months. Thirteen percent admitted they had never tested recovery capabilities.

Nelson says organisations needed to test, rather than assume, resilience.

“A backup strategy is only as good as an organisation’s ability to restore from it when something goes wrong,” he says.

Of course, it wouldn’t be a 2026 survey if it didn’t include AI, which is placing additional demands on data governance frameworks. Forty-five percent of respondents said AI adoption had influenced data infrastructure and storage decisions during the past year. At the same time, 43 percent said legacy systems, fragmented data platforms or unclear governance were slowing their ability to adopt AI safely.

Those challenges are not unique to New Zealand. The Governance Institute of Australia’s 2025 AI Deployment and Governance Survey identified governance, privacy and implementation challenges as organisations seek to move AI projects into production environments.

Lou Compagnone, Datacom director of AI, says many organisations are discovering that AI initiatives depend on the quality of underlying governance and data management practices.

“The organisations that get the most value from AI will be the ones that have done the foundational work first – trusted data, strong governance, clear access controls and confidence in where information is stored and who can access it,” Compagnone says.

More than a third of organisations surveyed said they are already reviewing where critical data is stored and managed, or plan to begin a review within the next six months.