On Wednesday, at the Data Centre Leaders Summit in Auckland, the industry group DataCentres New Zealand launched the country’s first sector-wide strategy for data centres. It argues that New Zealand should treat data centres as essential infrastructure and build local capacity rather than leaning on offshore processing for the digital services businesses, government and households use daily. Tech New Zealand chief executive Graeme Muller put the case plainly, saying “Every digital interaction depends on data centres. They are the backbone of our digital economy.”
He is right, and it is a sensible piece of work. The strategy asks for more predictable consenting and grid connections, a ministerial advisory group and an industry accord on standards, pointing to forecasts of USD 6.7 trillion in global data centre investment by 2030. About 6,800 people already work in data centres and supporting services here.
But the strategy is written at the altitude of megawatts and grid connections. Most business owners have a smaller and more immediate question nobody has answered for them. When a staff member pastes a customer’s complaint into a chatbot to soften the reply, where does that text go, who keeps a copy, and for how long.
That question is doing more to slow AI adoption here than any shortage of local compute. Research Xero published on 18 May, based on 1,081 New Zealand customers surveyed between 31 March and 7 April, found 45 per cent of small and medium businesses think AI could be the biggest opportunity since the internet. It also found 40 per cent held back over data privacy and security, and 26 per cent were outright sceptics. Those owners are not being timid. They are being asked to trust a system whose plumbing has never been explained to them.
Here is the part that surprises people who thought they had already dealt with this. Microsoft opened its Azure New Zealand North region in Auckland in December 2024 and Amazon Web Services opened its Asia Pacific New Zealand region on 1 September 2025. Many local organisations concluded, reasonably enough, that data sovereignty was solved. Pick the New Zealand region and you are done.
For storage and ordinary computing, largely true. For AI, not necessarily. When AWS announced in March that its Bedrock service was available from the New Zealand region, giving local customers access to Anthropic’s Claude models and Amazon’s own Nova models, it did so through what is called cross-region inference. AWS is clear about what that means. Data stays on its network and is encrypted in transit, but the Australia geographic profile spreads requests across Auckland, Sydney and Melbourne. The model is reached from New Zealand. It is not always run in New Zealand. None of that is hidden and none of it is a scandal, but it is a distinction marketing language flattens and almost nobody checks.
Where your database sits and where your prompts are processed are two different questions, and if you have only asked the first you have half a policy. The distinction matters legally because responsibility does not travel with the data. Under information privacy principle 12 of the Privacy Act 2020, a New Zealand organisation sending personal information overseas must satisfy itself that the recipient will protect it to a comparable standard, through that country’s law or through contract, or else obtain informed consent. The Office of the Privacy Commissioner has been consistent that the obligation sits with the organisation making the disclosure, not the offshore vendor receiving it. You can outsource the processing. You cannot outsource the accountability.
Meanwhile the largest AI facility being built in this country is not being built for us at all. Datagrid New Zealand won resource consent in March for a NZD 3.5 billion campus at Makarewa north of Invercargill, designed to reach 280 megawatts by 2028, which would make it the country’s second largest electricity user after Tiwai Point. Its output is destined for overseas markets through a subsea cable, and Datagrid signed the build contract for that cable in July. Technology adviser Mark Laurence told RNZ in March that the country risks becoming AI illiterate, saying “We’re still a nation that’s using AI to change the tone of an email and summarise long documents, while the rest of the world is pulling ahead in terms of redesigning whole workflows and injecting agentic AI at the full edge of its capability.”
A genuinely local option arrived last week and deserves more attention than it got. SiteHost, an Auckland hosting company running since 2004, launched an AI platform on 7 August where every request is processed on infrastructure in New Zealand, request data is not stored, and inputs are not used to train models. It runs open weight models, starting with Qwen 3.6 27B plus embedding and reranking models for search, priced by usage with no upfront fee from NZD 0.09 per million input tokens.
It is worth being honest about the trade. A 27 billion parameter open weight model is not a frontier model, and anyone expecting it to match the best of Anthropic or OpenAI on hard reasoning will be disappointed. But a great deal of everyday business AI work is not hard reasoning. Transcribing a meeting, summarising a document, tidying a product description, extracting fields from an invoice, powering a search box that understands what a customer meant. Mid sized models handle that work well, and it is exactly the work most likely to involve information you would rather not send offshore.
So what would I tell a client this week. First, sort your AI uses into two piles. One is content you would happily publish on your own website. The other is anything touching customer identity, health, financial or employment information. The first pile is a commercial decision about cost and quality. The second is a Privacy Act decision, and it deserves ten minutes of proper thought rather than a shrug.
Second, for that second pile, read the retention and training terms rather than the region badge. The useful questions are whether your input is stored, for how long, whether humans review it and whether it trains anything. Business tiers of the major platforms usually answer these well. Free consumer tiers, which is what most staff are quietly using, often do not.
Third, and this is where the web development side of my job intrudes, build the connection so you can change your mind later. Most of these services now speak the same API dialect that OpenAI established, SiteHost’s included, so moving a workload from an offshore provider to a local one can be a change of address and key rather than a rebuild. That is worth designing for now, while the integration is small. I have watched businesses lock themselves to a vendor through nothing more deliberate than hardcoding a URL in a hurry.
The strategy launched on Wednesday is the right ambition and I hope it succeeds. But the sovereignty that matters to a firm in Penrose or Papanui is not measured in megawatts. It is knowing where the words your staff typed this morning ended up, and being able to answer if a customer asks. That answer is available to any business that goes looking. Very few have looked.
Roger McSaveney is General Manager of Forge Creative, an Auckland web design and development agency.
Have you checked where your business AI data is processed, or is it still an open question? Share your experience in the comments below.
This article was written by AI, briefed to report the facts, hopefully without some of the bias people bring to the job π
Leave a Reply