Where AI tools keep New Zealand business data.

Where does each AI tool store and process NZ data?

Vendors answer two questions separately: where content is stored at rest, and where the model processes it. “Australian data residency” usually answers only the first. As listed on 20 October 2026:

Two patterns stand out. Training defaults bite on personal accounts, not business plans. And the newest models get regional processing last: on Google Cloud, Gemini 4 Argon is listed for US and EU processing only, and on Azure the GPT-6 models in Australia East are Global deployments.

What New Zealand privacy law asks of offshore AI tools

The Privacy Act 2020 does not require personal information to stay in New Zealand. It asks who uses it, for what, and how well it is protected. This is general information, not legal advice.

• Section 11. A provider that only stores or processes data for you is treated as part of your organisation. The Privacy Commissioner says your organisation remains fully responsible for what happens to it.
• Training changes the analysis. The Commissioner gives AI training as an example of a provider using information for its own purposes. Sending data to that provider can then be a disclosure.
• IPP 12. Disclosures overseas need one of the listed grounds; otherwise, the person’s permission.
• IPP 3A. Since 1 May 2026, collecting personal information from someone other than the individual triggers a notice duty. It matters when an AI tool enriches customer records from other sources.
• OPC expectations. The Commissioner’s AI guidance expects a privacy impact assessment before an AI tool is used.

So the practical question is less “is it onshore?” and more “is it a business plan that processes only on our behalf, with training off, and have we recorded that?” No vendor setting makes a tool compliant. Contracts, sector regulators and public sector rules can still require onshore data.

Can you keep AI processing in Australia or New Zealand?

Yes, for some workloads, through cloud platforms rather than chat apps. As listed on 20 October 2026:

• Amazon Bedrock. Bedrock has run in the Auckland region since March 2026. Its AU profile keeps Claude processing within Australia and New Zealand. The launch list was Claude Opus 4.6, Sonnet 4.6, Sonnet 4.5 and Haiku 4.5; check for newer models.
• Microsoft Foundry. In Australia East, pay-per-token regional deployments list GPT-4o, GPT-4.1 mini and embedding models; reserved (provisioned) capacity reaches GPT-5.4. Data Zone deployments process anywhere in Asia Pacific, a far wider area than Australia.
• Google Cloud. Gemini 3.5 Flash and Gemini 2.5 Flash are listed for processing in Sydney. Google warns that its endpoints alone “don’t guarantee data residency or in-region ML processing”.
• Self-hosted open-weight models. The only route that keeps processing in New Zealand by design; see running open models for business.

Our engineering guide to data residency for AI systems covers pinning regions in code and checking logs for where inference ran.

How do you check where your own tool keeps data?

Run this check on every tool and keep the evidence with your privacy impact assessment.

1. List each tool and plan in use. Include personal accounts staff use for work.
2. Read the setting, not the brochure. In ChatGPT Enterprise, the workspace’s General settings show the Data Residency Region. On Anthropic’s API, each response reports where inference ran in its usage.inference_geo field. In Google Workspace, the data regions advanced report breaks down storage and processing by region and application.
3. Trace the side doors. OpenAI says apps, MCP servers and web search follow their own providers’ terms. Google says data region settings do not apply to Gemini Notebook.
4. Record retention and training settings. Note any feedback buttons: Anthropic keeps a rated commercial conversation for up to five years.
5. Re-check at renewal. Regions, model lists and plan names changed often in 2026.

Our AI vendor evaluation checklist has the questions to send when a vendor’s pages do not answer them.

What residency costs

Residency is often a surcharge, and sometimes a plan change.

Worked example: a firm spending US$1,500 a month on Claude through Bedrock moves from the global endpoint to the AU profile. At a 10% premium that adds US$150 a month, or US$1,800 a year, before GST and currency conversion. For subscription tools the bigger cost is usually the plan change, such as moving from ChatGPT Business to a sales-led Enterprise agreement. Our AI tools pricing guide for New Zealand lists current seat prices.

Which route fits your data?

Choose a business plan with offshore processing if

• The data is ordinary business content or customer details you may process for this purpose.
• Training is off and you have confirmed retention settings.
• Your privacy impact assessment records the provider, countries and safeguards.

Choose Australian storage or an Australia and New Zealand route if

• A customer contract or internal policy names Australia or New Zealand.
• You need ChatGPT at scale and can buy Enterprise, or you are building on Bedrock or Azure.
• You can live with a narrower or older model list.

Choose self-hosting or onshore-only services if

• A contract, regulator or public sector rule requires processing in New Zealand.
• The data includes Māori data, health information or anything you would struggle to explain sending offshore.

Where residency claims mislead

• Storage without processing. OpenAI’s Australian region stores data but processing happens elsewhere. Microsoft’s New Zealand storage does not cover where Copilot runs the prompt.
• Exclusions inside a product. Microsoft says Anthropic models in Copilot are excluded from in-country processing commitments, and its Bing web queries fall outside its processor role.
• Connectors and web search. Data sent to a connected app or search provider follows that provider’s terms, whatever region you chose.
• Personal accounts. A staff member on a personal plan with training switched on undoes your business settings. Our lesson on protecting customer information when using AI covers the everyday rules.
• Lagging model lists. A residency decision can lock you to an older model.

Mapping tools, data classes and contracts into one decision is the core of our AI governance work.

Written by the Levy Street team in Wellington. Last updated 19 October 2026.