At a glance
Datacom's group chief executive told a Wellington AI conference on 8 September 2026 that logins, encryption keys and activity records for New Zealand-hosted services routinely sit in other countries.
Four in ten organisations have a written plan for the loss of their main cloud or hosting provider, and fewer have tested a restore.
The keynote lists six questions for buyers, covering where the keys and the activity records sit, how many days a recovery would take, and when any of it was last tested.
New Zealand's five international cables all come ashore in the upper North Island, and Amazon Web Services and Microsoft both run their New Zealand cloud regions out of Auckland.
Associate Transport Minister James Meager opened a 24-hour cable monitoring system on 18 June 2026, one of ten government workstreams on undersea infrastructure.
New Zealand-owned IT services company Datacom asked local organisations where they keep their data and found 64 per cent holding their most sensitive material in the country, against 35 per cent with a written policy on where it should sit and how that gets decided.
The company published that research in July 2026, and on 8 September 2026 group chief executive Greg Davidson used a keynote at the Aotearoa AI Summit, a two-day conference in Wellington, to argue that data residency and data control are separate questions.
Davidson told the summit that holding data in New Zealand does not deliver control of it, because the system that checks who your users are, the encryption keys and the record of who did what can all sit in other countries. Datacom's own research puts organisations with a written plan for the loss of their main provider at 41 per cent. The keynote sets out six questions in place of the location test.
Datacom runs five data centres here, at Orbit and Highbrook in Auckland, Kapua in Hamilton, Abel in Wellington and Gloucester in Christchurch. Its shareholders are Evander Management, the Holdsworth family's investment company, and the New Zealand Superannuation Fund.
Datacom's research puts tested recovery at 39 per cent
Datacom's keynote document puts the sample at 155 senior business and technology leaders.
Datacom reports 83 per cent of leaders concerned about storing data offshore or with an overseas provider, while "only 41% had a documented exit or migration plan if their primary provider became unavailable or unacceptable" and "just 39% had tested their ability to restore critical systems and data within the previous six months". Thirteen per cent had never tested a restore. Thirty-five per cent had a written policy on where critical data should sit, and 55 per cent had none.
A provider here is whoever holds the data or runs the service: a hyperscale cloud, a New Zealand operator selling colocation, or a software service a business rents rather than runs. Of those using local or hybrid storage, 56 per cent said their data was "hosted in data centres operated by hyperscale providers such as AWS, Microsoft Azure or Google". Among the 83 per cent worried about offshore storage, 60 per cent named legal access by foreign governments.
The 41 per cent counts the main one. Davidson's six questions cover every cloud and software service a business relies on.
Peter Nelson, Datacom's managing director for New Zealand, said organisations knew the risk and had not acted on it. "Organisations are paying much closer attention to where their critical data sits, who controls the infrastructure it relies on and what would happen if access was disrupted," he said. "The challenge is turning that awareness into practical action." On backups: "A backup strategy is only as good as an organisation's ability to restore from it when something goes wrong."
Datacom puts six questions to every cloud provider
Davidson's keynote sets out six questions to ask of every cloud and software service an organisation relies on. Datacom describes the six as its own list, not an industry standard, and applies them to the services it sells.
The question | What an answer has to contain |
|---|---|
Where the data, the processing, the login system, the encryption keys and the activity records each sit | As many as three countries, and the answer on the keys decides whether you can get back in |
Whether losing a region means switching to a standby or rebuilding from scratch | A number of days |
Which other services this one depends on that you never bought | Who runs them |
Who can compel access, and under whose law | Whether you would be told |
What happens to the business while the service is down | A documented continuity plan |
When any of it was last tested | A date |
Source: Datacom, Aotearoa AI Summit 2026 keynote speaking notes and supporting evidence, September 2026.
Davidson's notes argue that a provider whose staff, contracts and legal exposure sit in one country can answer all six faster than a service assembled across several.
A government buyer on the other side of the Tasman wrote down a version of the same test eight days before the keynote. Australia's definition of a sovereign technology supplier sits in the Digital Transformation Agency's contracting principles, published on 31 August 2026 for the pre-negotiated arrangements Australian departments buy technology under. Sovereignty is one of six principles a seller has to meet, and the agency's own supporting text says that where an extraterritorial jurisdiction compels a seller or its parent company, "data stored in Australia could be accessed and decrypted outside the border". Good practice, in the agency's words, is that "Information and infrastructure are located in Australia, subject to our legislation and regulations", that "Australian encryption prevents access from a foreign jurisdiction", and that sellers "notify our Australian Government immediately if information is accessed overseas".
Six companies hold one of those arrangements on the Department of Finance register updated on 23 July 2026: Amazon Web Services, IBM, Microsoft, Oracle, Rimini Street and SAP. A buyer with the market power of the Australian government reached the same conclusion Davidson did, which is that location alone settles nothing.
New Zealand's five cables come ashore in the upper North Island
Every provider in the country depends on the same five cable landings. The Ministry of Transport's progress report on undersea infrastructure, dated 17 March 2026, records "five current international cables" and says "over 99 percent of our international internet" travels on submarine cable. The report names no landing points and the cable owners publish city names only, so the table below draws on Land Information New Zealand and the Ministry's protected-area list. The Ministry counts the Southern Cross network's two New Zealand landings separately, as Southern Cross North and Southern Cross South, which is how five systems come ashore at the five points here.
New Zealand landing point | Cable system | Coast |
|---|---|---|
Muriwai Beach, Auckland, inland to the Whenuapai station | Southern Cross Cable Network | West |
Takapuna, Auckland | Southern Cross Cable Network | East |
Takapuna Beach, Auckland | Southern Cross NEXT | East |
Bream Tail, Mangawhai Heads, Northland | Hawaiki | East |
Ngarunui Beach, Raglan, Waikato | Tasman Global Access | West |
Source: Land Information New Zealand, Nautical Almanac 2025-26, section 13; Ministry of Transport cable protection areas; One NZ's Tasman Global Access announcement, 30 March 2017; Hawaiki Cable landing station announcement, 23 November 2016.
One NZ's 2017 announcement puts Tasman Global Access ashore at Ngarunui Beach in Raglan, and Hawaiki's landing station sits at Bream Tail on the Northland coast. The Ministry's list of protected cable areas carries Muriwai Beach as area five.
Amazon Web Services opened its New Zealand region in Auckland in 2025, and Microsoft's New Zealand North region has run since December 2024, also in Auckland. Neither discloses a capacity figure. Most of the country's built colocation capacity sits in the same city, across the operators covered in New Zealand's 208MW data centre market.
Meager opened a cable surveillance centre on 18 June 2026
Associate Transport Minister James Meager unveiled the National Surveillance and Warning Capability at Wellington's Maritime Operations Centre on 18 June 2026, in an announcement that names the network operator Kordia and the maritime tracking firm Starboard Maritime Intelligence as its builders. Meager called it a world first, and the rollout follows a trial in the Hauraki Gulf and Muriwai cable areas.
Meager said submarine cables "carry around 99 percent of our data traffic" and that large volumes of them are "vulnerable to damage, particularly those in waters shallower than 200 metres which lie close to busy fishing and shipping routes". He set the system inside a wider programme of ten workstreams on critical undersea infrastructure, a count the Ministry of Transport's maritime security strategy page carries too. The March progress report records eight of the options as "either in place or progressing as expected with two options dependent on partners".
Vocus detected a break on the Australia Singapore Cable on 4 September 2026, four days before the keynote, and says the fault appears to be in Indonesian waters. Wavelength and Ethernet services between Perth and Singapore became unavailable and traffic was rerouted. Vocus has engaged a marine repair partner and has published no restoration date.
What to watch
Whether buyers put the six questions in writing. The six are answerable in days and dollars, and the providers they would be put to are listed among New Zealand's data centre operators. Datacom has not said when it will repeat the research.
Whether Honomoana, SX Tasman Express or Tasman Ring gets a service date. Google's Honomoana will add a branch to Auckland under a Vocus and Google agreement announced on 30 April 2024, which gives Vocus dark fibre across the system and up to 30Tbps between Australia and New Zealand. No ready-for-service date has been announced for the Auckland end. SX Tasman Express, contracted by Southern Cross with ASN and OMS Group on 4 June 2025, is scheduled for 2028. Datagrid's Tasman Ring, announced on 31 July 2026, targets 2029 and would be the first to come ashore in the South Island.
Whether recovery times start appearing in tenders. Three new cable systems are contracted and none is in service, while the New Zealand data centre build keeps commissioning capacity. No standard New Zealand procurement template asks a provider for a restore time.
Whether the rules pick up the same test. Both major parties have published data centre conditions ahead of the 7 November 2026 election. Those conditions cover energy and water. Encryption keys and activity records stay a matter for the contract, and Datacom puts tested recovery at 39 per cent.