The cloud has come home. Sovereignty is still deciding where it lives.

For most of the cloud era, “the cloud” for New Zealand organisations meant Sydney. In the space of nine months, that changed.

Microsoft went first, opening the country’s first hyperscale cloud region in December 2024. New Zealand North is a full three zone region on Auckland’s North Shore, with early customers including ASB, BNZ, Fonterra, ACC and Auckland Transport. Microsoft has not put a public figure on the build, described in reporting at the time as many hundreds of millions of dollars, and it paired the launch with a ten year renewable energy agreement covering Contact Energy’s Te Huka geothermal station and a commitment to help 100,000 New Zealanders build digital and AI skills.

AWS followed on 1 September 2025 with its Asia Pacific (New Zealand) Region: three availability zones, a planned investment of more than NZ$7.5 billion, and renewable energy from day one through a long term wind farm agreement. The company estimates the operation will contribute roughly NZ$10.8 billion to GDP and support more than 1,000 full time jobs a year.

What onshore changes, and what it does not

For government and regulated sectors, this closes a long-standing gap. The Cloud First policy directs agencies to store data classified RESTRICTED or below in public cloud, and official guidance signals that RESTRICTED information should move over time into New Zealand based data centres where a suitable onshore service exists. Two full local regions take the traditional objections, latency and residency chief among them, largely off the table. Banks, insurers and health providers with data residency preferences can now run hyperscale services without their data leaving the country.

But the government’s own jurisdictional risk guidance is blunt about the limits: jurisdictional risks are still present in onshore data centres where the products and services are owned by offshore vendors. Data can sit in Auckland and remain reachable under another country’s laws. Residency, in other words, is not sovereignty.

A distinctly New Zealand question

That distinction lands hardest in the Māori data sovereignty conversation, and it is where New Zealand’s version of this debate differs from anywhere else. Government cloud guidance requires agencies to consider te ao Māori perspectives when making cloud decisions, recognising that for Māori, data is a taonga.

Organisations are responding in different ways. Te Tumu Paeroa, the Office of the Māori Trustee, which administers around 1,800 Māori land trusts on behalf of more than 100,000 owners, spent over two years building a Māori data sovereignty framework before becoming an anchor tenant of Microsoft’s region, with data residency in Aotearoa as a core principle. Others have built their own path entirely: Te Kāhui Raraunga launched Te Pā Tūwatawata in 2025, a Māori designed and governed encrypted data storage network for iwi, hapū and marae, with advocates arguing that sovereignty which stops at the server door is no sovereignty at all.

The debate is global, the answers are local

New Zealand is having this argument at the same moment as everyone else. Gartner expects worldwide sovereign cloud infrastructure spending to reach about US$80 billion in 2026, up more than a third year on year, with governments the biggest buyers and around 20 percent of workloads predicted to shift from global public clouds to local providers. Industry reporting describes CIOs internationally repatriating workloads and standing up sovereign cloud zones as regulation tightens and geopolitics hardens.

For New Zealand tech leaders, the hyperscalers arriving onshore has resolved the easier half of the question. The harder half remains open: who can compel access to your data, whose values govern how it is treated, and how much national resilience should rest on infrastructure owned by two American companies. That conversation has moved from the data centre to the boardroom. Which is exactly where it belongs.