Aratohu · Guide
Kei hea ōku raraunga?Where does my website and CRM data live? A plain-English guide for NZ businesses
Your customer data sits on servers your providers choose. Here is how to find out where, what the law asks of you, and why some buyers ask more.
He whakautu poto / Short answer: Your website and CRM data lives in whichever data centres your providers use - often overseas. The Privacy Act 2020 does not require it to stay in New Zealand, but you stay responsible for keeping it secure (IPP 5), and IPP 12 applies when you disclose it to an overseas organisation that uses it for its own purposes. Ask every vendor where, and who.
Updated 25 September 2026 · 7 min read
This guide explains where your website and CRM data lives and why it matters for a New Zealand business. It covers hosting regions, what the Privacy Act 2020 asks, the questions worth putting to any vendor, and why public-sector and iwi buyers often ask more. It is general information, not legal advice.
Te roheWhat is a hosting region?
A hosting region is the geographic area where a cloud provider's data centres sit - for example Sydney, Singapore or Virginia. When a software vendor says your data is "in the cloud", it is on physical servers in one or more regions. Backups, email delivery and support tools can sit in different regions again.
Some large cloud providers now run regions in New Zealand, so in-country hosting is more available than it was a few years ago. Whether a given vendor uses one is a separate question - ask them.
Me noho ki Aotearoa?Does the Privacy Act require data to stay in New Zealand?
Generally, no. Two parts of the Privacy Act 2020 do the work:
- Section 11 and IPP 5. If a provider holds data only on your behalf and does not use it for its own purposes, the Act treats the information as held by you. You remain responsible for its security, wherever the server is.
- IPP 12. If you disclose personal information to an overseas recipient that uses it for its own purposes, you must rely on one of the listed grounds, for example reasonably believing it will be protected to a standard comparable to the Act - shown through contract terms such as the Privacy Commissioner's model clauses - or the person's authorisation after being told it may not be protected that way.
Public-sector agencies have their own government guidance on using cloud services, and some contracts or industry rules set residency requirements. Those sit on top of the Act. Our guide to the Privacy Act 2020 and website tracking covers the other principles.
Ngā pātaiWhat should you ask any website or CRM vendor?
| Question | Why it matters |
|---|---|
| Which region stores my account's data, and where are backups kept? | Tells you which countries the data sits in, and whether backups follow it. |
| Which sub-processors handle it, and where? | Email, support and analytics tools can move data to other countries. |
| Do you use my customers' data for your own purposes? | If so, sharing it is a disclosure, and IPP 12 applies to an overseas recipient. |
| Who on your side can access it, and is access logged? | Security under IPP 5 includes the vendor's own staff. |
| How will you tell me about a breach? | You may need to notify the Privacy Commissioner, and you need to hear quickly. |
| How do I export everything, and what happens to data when I leave? | Keeps you in control of the relationship, not locked in. |
Te mana motuhake o ngā raraunga MāoriWhat is Māori data sovereignty?
Māori data sovereignty is the view that Māori have inherent rights and interests in data about or from Māori - people, language, culture, resources and environments - and that this data should be subject to Māori governance. Te Mana Raraunga, the Māori Data Sovereignty Network, has published six principles to guide this, grounded in Te Tiriti o Waitangi: rangatiratanga (authority), whakapapa (relationships), whanaungatanga (obligations), kotahitanga (collective benefit), manaakitanga (reciprocity) and kaitiakitanga (guardianship).
This is a summary, not an interpretation. The principles belong to the people who wrote them, and they are best read in full at temanararaunga.maori.nz. For a business, the practical point is that where data sits is only part of the question: who decides how it is used, and who benefits, matter as much.
He aha ai?Why do public-sector and iwi buyers ask these questions?
Iwi, hapū, Māori trusts and incorporations often hold information about their members and whānau, and many have their own expectations about how that information is governed. Public-sector agencies work under government cloud guidance and obligations that include Te Tiriti o Waitangi. Both are likely to ask where data is hosted, who can access it, whether it leaves the country, and whether the organisation keeps control. Straight answers, in writing, are what these buyers need. A vendor should not claim to meet Māori data sovereignty principles on an organisation's behalf; that judgement belongs to the organisation and the people the data is about.
Me pēhea te kimi?How do you find out where your data lives?
Make a list of your tools
Include your website host, form tool, CRM, email platform, analytics and any booking or payment tools. Each one holds some customer information.
Ask each vendor where data is stored
Ask for the hosting region for your account and for backups, and which other companies (sub-processors) handle the data.
Work out who uses it for their own purposes
A provider acting only on your behalf is different from one that uses the data itself. The second is a disclosure, and IPP 12 applies if it is overseas.
Check the contract
Look for terms on security, breach notification, sub-processors, deletion at the end of the contract, and how you export your data.
Record your answers
Keep a simple register of tools, regions and contracts, and update your privacy statement so customers can see where their information goes.
Te tūranga o uForgeWhere does uForge fit?
uForge is not available in New Zealand yet, and we have not opened a New Zealand region. Today, UK customer data is hosted in AWS London, and Thai customers' core platform data is hosted in AWS Bangkok. We have not yet said where New Zealand data will be hosted, and we will state it plainly before we open. Read more on first-party data or browse all New Zealand guides.
Register your interest in uForge Aotearoa and we will tell you when it opens in New Zealand, and where New Zealand data will be hosted.