‘Data sovereignty’ in New Zealand is mostly about how you deploy — running a model-agnostic platform in an Auckland cloud region or on your own infrastructure. A plain-English look at residency, the Privacy Act, Māori Data Sovereignty and the US CLOUD Act.
dgm is an independent osFoundry integration partner — not affiliated with the company that makes osFoundry, and dgm has not yet completed any client integrations. This article describes services dgm offers, not past results.
What ‘data sovereignty’ means in New Zealand
In New Zealand, data sovereignty is mostly about how you deploy, not any one vendor’s branding. The real questions are: where does the data sit, who can reach it under which jurisdiction, and how freely can you change model or provider?
Three layers to keep separate
| Layer | New Zealand options |
|---|---|
| Data location | An Auckland cloud region (AWS ap-southeast-6 / Azure New Zealand North), an NZ-owned provider (Catalyst Cloud / Datacom / CCL), or local-first |
| Model | Open-weight models via BYOK, or commercial models — your choice |
| Platform | A model-agnostic, self-hostable platform, to avoid lock-in to a single vendor |
Māori Data Sovereignty
One genuinely New Zealand-specific dimension is Māori Data Sovereignty. Te Mana Raraunga, the Māori Data Sovereignty Network, has published six principles — Rangatiratanga (authority/self-determination over data), Whakapapa (relationships and context), Whanaungatanga (obligations and accountabilities), Kotahitanga (collective benefit), Manaakitanga (reciprocity and an ethic of care) and Kaitiakitanga (guardianship). These sit alongside the CARE Principles for Indigenous Data Governance (Collective benefit, Authority to control, Responsibility, Ethics) from the Global Indigenous Data Alliance, and the Māori Data Governance Model developed by Te Kāhui Raraunga with Stats NZ under the Mana Ōrite relationship agreement. The point is not physical location — it is authority, relationship and guardianship over Māori data. If your AI system will touch data about Māori people, communities or taonga, these principles are a real governance framework to engage with honestly, cited to their source, rather than reduced to a generic ‘data stays local’ line. (A related example is Te Hiku Media’s Papa Reo te reo Māori speech models, released under a guardianship-based Kaitiakitanga License — they are access-controlled and Māori-benefit-directed, not a redistributable open-source model.)
Data and jurisdiction
osFoundry’s managed cloud can pin data to its US, EU or Japan regions — there is no managed New Zealand region (the nearest managed options are Australia or Japan). If you need data to stay in New Zealand, the practical options are real today: AWS Asia Pacific (New Zealand), region ap-southeast-6 in Auckland, has been generally available since 1 September 2025, and Microsoft Azure New Zealand North (newzealandnorth, Auckland) is generally available — so you can self-host osFoundry in your own in-country cloud account (BYO cloud), or run it local-first on your own infrastructure. Google Cloud has no New Zealand region (the nearest is Sydney, australia-southeast1). There are also NZ-owned sovereign providers — Catalyst Cloud, Datacom and CCL/Revera — that keep data under New Zealand ownership and law. One caveat worth stating plainly: the US CLOUD Act (2018) lets US authorities compel data held by US-headquartered providers regardless of where it is physically stored, so an Auckland AWS or Azure region improves physical location and helps with the Privacy Act 2020 but does not by itself remove the jurisdictional exposure of a US-parent provider. Physical residency is not the same as jurisdictional sovereignty — verify the right region and provider for your own risk profile.
How dgm can help
dgm is an independent integration partner that helps New Zealand organisations put osFoundry to work — from choosing a worthwhile first use case through to the hands-on build and connecting it to the systems you already run. dgm can help design a realistic data-sovereignty architecture for your organisation — the right region, model and hosting approach. dgm is not affiliated with the company that makes osFoundry, and it has not yet completed any client integrations, so what is described here is the service dgm offers, not past results. If you want help scoping a realistic first project, dgm can work through it with you.