On 3 August, Governor Greg Abbott declared a moratorium on all new power-grid connections for data centres in Texas, and directed the Public Utility Commission and ERCOT to audit every project already moving through the interconnection queue. As Ars Technica reported, the same governor had called Texas the epicentre of AI development less than a year earlier. Nothing in that decision concerns privacy. It concerns electricity. Which is the useful part: where your records physically sleep is a variable set by people you will never meet, and it moves.
Sovereignty is mostly used as a slogan, and slogans cannot be acted on. Underneath it sit three separable questions, which a small business can answer one at a time in an afternoon. Which state can compel someone to hand over your records. Which law governs what may be done with them. And whether you can leave — how fast, and at what price.
The first has a settled answer that vendor pages tend to skate past. The Clarifying Lawful Overseas Use of Data Act, signed on 23 March 2018, provides that a provider subject to United States jurisdiction must preserve and produce data in its possession, custody or control regardless of whether the servers sit inside or outside the country. Jurisdiction follows the company, not the building. A database in a Sydney or Auckland region operated by an American corporation is reachable through the parent; the same database on a machine belonging to a company incorporated where you live is not. That is not an argument against American providers — we run on several — but it does settle what the phrase "hosted locally" buys and what it does not.
New Zealand looks stricter than it is. Principle 12 of the Privacy Act 2020 reads like a transfer rule: you may send personal information overseas only if the recipient is bound by comparable safeguards, by law or by agreement, or the person has expressly agreed. Section 11 then removes most of its force: information held by an agent is treated as held by the principal, so the Office of the Privacy Commissioner's own guidance says that in most circumstances you will be responsible for the personal information you put in the cloud, not the cloud provider — and no principle 12 agreement is required where the provider acts purely as your agent. Read plainly: nothing in New Zealand law stops a five-person firm putting its entire client base on a server anywhere on earth. Since 1 May 2026 there is one new duty worth diarising: principle 3A requires you to tell people when you have collected information about them from somebody other than them.
Kanaky (New Caledonia) runs the opposite default, which surprises people on both sides of the Coral Sea. The GDPR does not apply there as European law — the territory is not EU soil for that purpose. But ordonnance n° 2018-1125 of 12 December 2018 rewrote the loi Informatique et Libertés so that its provisions refer across to the European text, and since 1 June 2019 the territory has been under the same regime as metropolitan France, with the CNIL competent to inspect and to fine. A Nouméa business therefore lives with transfer rules, purpose limitation and a record of processing that its Auckland counterpart does not, and is exposed to European-scale penalties for ignoring them.
| New Zealand | Kanaky (New Caledonia) | |
|---|---|---|
| Governing text | Privacy Act 2020 | Loi Informatique et Libertés, extended by ordonnance n° 2018-1125 |
| Hosting offshore | Permitted, and not a disclosure where the provider is your agent (s 11) | A transfer, requiring a lawful basis and safeguards |
| Regulator | Privacy Commissioner — compliance notices, no general fining power | CNIL — inspection and fining powers |
| Largest fine | $10,000, and only for obstruction-type offences under s 212 | European scale, up to 4 per cent of worldwide turnover |
| Newest duty | Principle 3A since 1 May 2026 — disclose indirect collection | Aligned with metropolitan France since 1 June 2019 |
AWS opened its Asia Pacific (New Zealand) Region in Auckland on 2 September 2025 — three availability zones and a stated NZ$7.5 billion investment. For an Auckland firm, keeping data in the country is now a dropdown menu.
For a Nouméa firm it is not. The nearest hyperscaler region remains Sydney, so local resolves to one of two things: an Australian region operated by a foreign company, or one of the datacentres operated inside the territory by Caledonian hosting firms, several of which now hold French health-data certification. Both are defensible choices. Neither is automatic.
Because a server in Nouméa is not safer for being in Nouméa. A local machine with no off-site backup, no restore ever tested and one person who knows the password is a worse custodian of a client list than any hyperscaler region on the planet. We have seen both, in the same week. Sovereignty you cannot operate is a sticker on a rack.
Europe has legislated precisely this question, which makes it the only place with a public benchmark. Regulation (EU) 2023/2854, the Data Act, became applicable on 12 September 2025 and requires providers to strip out contractual and technical barriers to switching, with termination on a maximum two months' notice. Until 12 January 2027 a provider may charge for the switch only what it actually costs; after that date switching charges are prohibited outright. The obligations reach non-EU providers serving EU customers.
No legislature in New Zealand, Australia or the French Pacific has done anything comparable. So the exit is a contract question here, and it is yours to raise. Two numbers convert it from principle into a decision: how many hours to obtain a complete, usable copy of everything you hold there, and what the provider charges to hand it over. Ask both in writing before signing. A vendor who cannot answer the first question has told you the answer.
No. Principle 12 of the Privacy Act 2020 controls disclosure of personal information to overseas recipients, but section 11 treats information held by an agent as held by you — and the Office of the Privacy Commissioner's guidance states that a cloud provider storing or processing data purely on your behalf falls in that category, so no principle 12 agreement is required. The responsibility does not move: it stays with you, including for a breach at the provider. What changed most recently is principle 3A, in force since 1 May 2026, which requires you to tell people when you have collected information about them from a third-party source.
Not directly, and the distinction matters more in theory than in practice. The territory is not EU soil for the purposes of the regulation, so the GDPR does not apply there of its own force. Ordonnance n° 2018-1125 of 12 December 2018 rewrote the loi Informatique et Libertés so that its provisions refer expressly across to the European text, and since 1 June 2019 New Caledonia has been under the same regime as metropolitan France, with the CNIL competent to inspect and to sanction. For a business in Nouméa the working answer is: assume GDPR-grade obligations, including on transfers outside the territory.
Not by virtue of being local. Sovereignty and security are separate properties and a small local machine frequently loses on the second one: no off-site copy, no tested restore, no patching discipline, one person holding the password. A hyperscaler region gives you durability and operational hygiene you would struggle to reproduce, at the price of a legal chain that reaches back to its parent company. The defensible position is to split by sensitivity rather than to pick a side — the records whose publication would damage the business on infrastructure you control, everything else where it runs best.
The Clarifying Lawful Overseas Use of Data Act of 23 March 2018 provides that a provider subject to United States jurisdiction must produce data in its possession, custody or control regardless of where the servers are located. The practical consequence: choosing an Australian or New Zealand region from an American provider changes latency and residency, but not who can be ordered to produce the data. If that specific risk matters to your records, the variable to change is the nationality of the company on the contract, not the location of the building.
Kanaky Tech is an AI automation agency working across New Zealand and the Pacific. Start with a free AI opportunity audit: we map how your business actually runs, rank what is worth automating, and give you a clear scope before anything is built — no obligation.