# Where AI tools keep New Zealand business data. URL: https://levystreet.com/compare/ai-data-residency-nz/ Updated: 2026-10-19 ChatGPT data residency in NZ and beyond: where ChatGPT, Claude, Microsoft Copilot and Gemini store and process business data, which regions you can choose. ## Short answer None of ChatGPT, Claude, Microsoft Copilot or Gemini for Workspace guarantees that prompts are processed in New Zealand, as listed on 20 October 2026. ChatGPT Enterprise and the OpenAI API can store data at rest in Australia. Microsoft 365 can keep Copilot data at rest in New Zealand. For Claude processing kept within Australia and New Zealand, use Amazon Bedrock's AU profile. - ChatGPT data residency is for Enterprise, Edu and the API; Australia means storage, not processing. - Anthropic stores Claude commercial data in the US; its own API offers only US or global inference. - Microsoft 365 can hold Copilot data at rest in New Zealand; prompts may be processed offshore. - Gemini in Workspace data regions offer only the United States or Europe. - Business plans from all four vendors do not train on your content by default. ## Where does each AI tool store and process NZ data? Vendors answer two questions separately: where content is stored at rest, and where the model processes it. "Australian data residency" usually answers only the first. As listed on 20 October 2026: | Tool and plan | Where data is stored | Can you pick a region? | Trains on your data by default? | Source | |---|---|---|---|---| | ChatGPT Free, Go, Plus, Pro | No residency option | No | Yes, opt-out available | [OpenAI pricing](https://chatgpt.com/pricing/) | | ChatGPT Business | No residency option on self-serve Business | No | No | [OpenAI enterprise privacy](https://openai.com/enterprise-privacy/) | | ChatGPT Enterprise and Edu | Chosen region at rest, from ten including Australia; not New Zealand | Yes, for new workspaces; in-region inference only in Europe, the US and the UAE | No | [OpenAI residency](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt) | | OpenAI API | Australia stores data but does not process it there | Yes, with sales approval | No | [OpenAI API data controls](https://developers.openai.com/api/docs/guides/your-data) | | Claude Free, Pro, Max | Not stated for consumer plans | No | Only if the model-improvement setting is on | [Anthropic consumer training](https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training) | | Claude Enterprise (Anthropic's storage article does not name Team) | United States; traffic may route to the US, Europe, Asia and Australia | US-only inference for Enterprise on usage billing | No | [Anthropic servers](https://privacy.claude.com/en/articles/7996890-where-are-your-servers-located-do-you-host-your-models-on-eu-servers) | | Claude API (Anthropic) | Workspace storage "us" only | Inference "global" or "us" | No | [Anthropic data residency](https://platform.claude.com/docs/en/manage-claude/data-residency) | | Claude via Amazon Bedrock | Logs and configuration stay in your chosen AWS Region, such as Auckland | Yes: AU profile processes in Auckland, Sydney or Melbourne | Model providers cannot see your prompts | [AWS](https://aws.amazon.com/blogs/machine-learning/run-generative-ai-inference-with-amazon-bedrock-in-asia-pacific-new-zealand/) | | Microsoft Copilot (Microsoft 365) | Your tenant's geography; New Zealand is eligible for Advanced Data Residency | At rest yes; processing may be in the US, EU or elsewhere | No | [Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) | | Azure OpenAI (Microsoft Foundry) | Australia East; no New Zealand North entry | Yes, but regional deployments there list GPT-5.4 and older, not GPT-6 | No | [Microsoft Learn](https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/models-sold-directly-by-azure-region-availability) | | Gemini in Google Workspace | Data regions: United States, Europe or no preference | US or EU only; in-region processing on Enterprise Plus, Enterprise Essentials Plus and Frontline Plus | No | [Google Admin Help](https://knowledge.workspace.google.com/admin/compliance/choose-a-geographic-location-for-your-data) | | Gemini and Claude via Google Cloud | Sydney processing listed for Gemini 3.5 Flash and Gemini 2.5 Flash only | Partly; Claude's listed regions are the US, EU and Singapore | No | [Google Cloud](https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/data-residency) | Two patterns stand out. Training defaults bite on personal accounts, not business plans. And the newest models get regional processing last: on Google Cloud, Gemini 4 Argon is listed for US and EU processing only, and on Azure the GPT-6 models in Australia East are Global deployments. ## What New Zealand privacy law asks of offshore AI tools The [Privacy Act 2020](https://www.legislation.govt.nz/act/public/2020/31/en/latest/) does not require personal information to stay in New Zealand. It asks who uses it, for what, and how well it is protected. This is general information, not legal advice. - **Section 11.** A provider that only stores or processes data for you is treated as part of your organisation. The Privacy Commissioner says your organisation [remains fully responsible](https://www.privacy.org.nz/resources-and-learning/a-z-topics/working-with-third-party-providers/) for what happens to it. - **Training changes the analysis.** The Commissioner gives AI training as an example of a provider using information for its own purposes. Sending data to that provider can then be a disclosure. - **IPP 12.** Disclosures overseas need one of the listed grounds; [otherwise](https://www.privacy.org.nz/privacy-principles/12/), the person's permission. - **IPP 3A.** Since 1 May 2026, collecting personal information from someone other than the individual triggers a [notice duty](https://www.privacy.org.nz/resources-and-learning/a-z-topics/ipp3a/). It matters when an AI tool enriches customer records from other sources. - **OPC expectations.** The Commissioner's [AI guidance](https://www.privacy.org.nz/assets/New-order/Resources-/Publications/Guidance-resources/AI-Guidance-Resources-/AI-and-the-Information-Privacy-Principles.pdf) expects a privacy impact assessment before an AI tool is used. So the practical question is less "is it onshore?" and more "is it a business plan that processes only on our behalf, with training off, and have we recorded that?" No vendor setting makes a tool compliant. Contracts, sector regulators and public sector rules can still require onshore data. ## Can you keep AI processing in Australia or New Zealand? Yes, for some workloads, through cloud platforms rather than chat apps. As listed on 20 October 2026: - **Amazon Bedrock.** Bedrock has run in the [Auckland region](https://aws.amazon.com/blogs/machine-learning/run-generative-ai-inference-with-amazon-bedrock-in-asia-pacific-new-zealand/) since March 2026. Its AU profile keeps Claude processing within Australia and New Zealand. The launch list was Claude Opus 4.6, Sonnet 4.6, Sonnet 4.5 and Haiku 4.5; check for newer models. - **Microsoft Foundry.** In Australia East, pay-per-token [regional deployments](https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/models-sold-directly-by-azure-region-availability) list GPT-4o, GPT-4.1 mini and embedding models; reserved (provisioned) capacity reaches GPT-5.4. Data Zone deployments process anywhere in Asia Pacific, a far wider area than Australia. - **Google Cloud.** Gemini 3.5 Flash and Gemini 2.5 Flash are listed for processing in Sydney. Google warns that its endpoints alone "don't guarantee data residency or in-region ML processing". - **Self-hosted open-weight models.** The only route that keeps processing in New Zealand by design; see [running open models for business](/engineering/running-open-models-for-business/). Our engineering guide to [data residency for AI systems](/engineering/data-residency-for-ai-systems/) covers pinning regions in code and checking logs for where inference ran. ## How do you check where your own tool keeps data? Run this check on every tool and keep the evidence with your privacy impact assessment. 1. **List each tool and plan in use.** Include personal accounts staff use for work. 2. **Read the setting, not the brochure.** In ChatGPT Enterprise, the workspace's General settings show the Data Residency Region. On Anthropic's API, each response reports where inference ran in its `usage.inference_geo` field. In Google Workspace, the data regions advanced report breaks down storage and processing by region and application. 3. **Trace the side doors.** OpenAI says apps, MCP servers and web search follow their own providers' terms. Google says data region settings do not apply to Gemini Notebook. 4. **Record retention and training settings.** Note any feedback buttons: Anthropic keeps a rated commercial conversation for up to five years. 5. **Re-check at renewal.** Regions, model lists and plan names changed often in 2026. Our [AI vendor evaluation checklist](/resources/ai-vendor-evaluation-checklist/) has the questions to send when a vendor's pages do not answer them. ## What residency costs Residency is often a surcharge, and sometimes a plan change. | Option, as listed on 20 October 2026 | Cost of keeping data in region | |---|---| | ChatGPT Enterprise and Edu | Included at no extra cost, on a sales-led plan | | OpenAI API residency endpoints | 10% uplift on models released from 5 March 2026 | | Anthropic API, US-only inference | 1.1 times standard token prices | | Claude on Bedrock or Google Cloud, regional endpoints | 10% premium over global endpoints | | Microsoft Advanced Data Residency | Add-on that must cover 100% of paid licences in the tenant | | Gemini in Workspace in-region processing | Needs Enterprise Plus or Frontline Plus | Worked example: a firm spending US$1,500 a month on Claude through Bedrock moves from the global endpoint to the AU profile. At a 10% premium that adds US$150 a month, or US$1,800 a year, before GST and currency conversion. For subscription tools the bigger cost is usually the plan change, such as moving from ChatGPT Business to a sales-led Enterprise agreement. Our [AI tools pricing guide for New Zealand](/resources/ai-tools-pricing-nz/) lists current seat prices. ## Which route fits your data? ### Choose a business plan with offshore processing if - The data is ordinary business content or customer details you may process for this purpose. - Training is off and you have confirmed retention settings. - Your privacy impact assessment records the provider, countries and safeguards. ### Choose Australian storage or an Australia and New Zealand route if - A customer contract or internal policy names Australia or New Zealand. - You need ChatGPT at scale and can buy Enterprise, or you are building on Bedrock or Azure. - You can live with a narrower or older model list. ### Choose self-hosting or onshore-only services if - A contract, regulator or public sector rule requires processing in New Zealand. - The data includes Māori data, health information or anything you would struggle to explain sending offshore. ## Where residency claims mislead - **Storage without processing.** OpenAI's Australian region stores data but processing happens elsewhere. Microsoft's New Zealand storage does not cover where Copilot runs the prompt. - **Exclusions inside a product.** Microsoft says [Anthropic models in Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/enterprise-data-protection) are excluded from in-country processing commitments, and its Bing web queries fall outside its processor role. - **Connectors and web search.** Data sent to a connected app or search provider follows that provider's terms, whatever region you chose. - **Personal accounts.** A staff member on a personal plan with training switched on undoes your business settings. Our lesson on [protecting customer information when using AI](/learn/protecting-customer-information-when-using-ai/) covers the everyday rules. - **Lagging model lists.** A residency decision can lock you to an older model. Mapping tools, data classes and contracts into one decision is the core of our [AI governance](/services/ai-governance/) work. ## Questions people ask ### Does ChatGPT store data in New Zealand? No. As listed on 20 October 2026, OpenAI offers ChatGPT data residency in ten regions, including Australia but not New Zealand, and only for new ChatGPT Enterprise and Edu workspaces and eligible API customers. Self-serve ChatGPT Business has no residency option. Even with Australian residency, model inference runs elsewhere, because OpenAI offers in-region inference only for Europe, the United States and the United Arab Emirates. ### Is it legal for a New Zealand business to use an AI tool hosted overseas? The Privacy Act 2020 does not ban offshore storage or processing. If the provider only processes data on your behalf, section 11 treats it as part of your organisation and you stay responsible for security. If it uses the data for its own purposes, such as training, sending it can be a disclosure, and IPP 12 applies to disclosures overseas. This is general information; take advice for your situation. ### Can I keep Claude processing in Australia or New Zealand? Not through Anthropic's own apps or API, which offer only global or US inference and store data in the US. Amazon Bedrock's AU profile, called from Auckland, routes Claude requests to Auckland, Sydney or Melbourne. At its March 2026 launch the profile covered Claude Opus 4.6, Sonnet 4.6, Sonnet 4.5 and Haiku 4.5, so check which current models it offers before you design around it. ### Does Microsoft Copilot keep New Zealand data in New Zealand? At rest, it can. New Zealand is one of Microsoft 365's local region geographies, and the Advanced Data Residency add-on covers Copilot and Copilot Chat data, but it must cover every paid licence in the tenant. Processing is a different matter: Microsoft says customers outside the EU may have Copilot queries processed in the US, the EU or other regions, and its in-country processing plan does not name New Zealand. ### Do AI tools train on my business data? Not on business plans by default. OpenAI excludes ChatGPT Business, Enterprise and API data from training, Anthropic excludes Claude for Work and API data, and Microsoft and Google say Copilot and Gemini for Workspace content is not used to train their models. Personal accounts differ: ChatGPT Free, Go, Plus and Pro train unless you opt out, and Claude Free, Pro and Max train when the model-improvement setting is on. ## Sources - [Data residency and inference residency for ChatGPT](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt) - [Data controls in the OpenAI platform](https://developers.openai.com/api/docs/guides/your-data) - [ChatGPT plans and pricing](https://chatgpt.com/pricing/) - [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/) - [Where are your servers located?](https://privacy.claude.com/en/articles/7996890-where-are-your-servers-located-do-you-host-your-models-on-eu-servers) - [Data residency](https://platform.claude.com/docs/en/manage-claude/data-residency) - [Is my data used for model training? (commercial)](https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training) - [Is my data used for model training? (consumer)](https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training) - [Run generative AI inference with Amazon Bedrock in Asia Pacific (New Zealand)](https://aws.amazon.com/blogs/machine-learning/run-generative-ai-inference-with-amazon-bedrock-in-asia-pacific-new-zealand/) - [Data protection in Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html) - [Data, privacy and security for Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) - [Enterprise data protection in Microsoft Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/enterprise-data-protection) - [Microsoft offers in-country data processing to 15 countries](https://www.microsoft.com/en-us/copilot/blog/2025/11/04/microsoft-offers-in-country-data-processing-to-15-countries-to-strengthen-sovereign-controls-for-microsoft-365-copilot/) - [Advanced Data Residency overview](https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-adr-overview) - [Foundry Models sold by Azure: region availability](https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/models-sold-directly-by-azure-region-availability) - [Data, privacy and security for Azure Direct Models](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) - [Data regions: choose a geographic location for your data](https://knowledge.workspace.google.com/admin/compliance/choose-a-geographic-location-for-your-data) - [Data regions support for the Gemini app now available](https://workspaceupdates.googleblog.com/2026/06/gemini-app-data-regions-support.html) - [Generative AI in Google Workspace Privacy Hub](https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub) - [Data residency (Gemini Enterprise Agent Platform)](https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/data-residency) - [Zero data retention and training restriction](https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/zero-data-retention) - [Privacy Act 2020](https://www.legislation.govt.nz/act/public/2020/31/en/latest/) - [Working with third-party providers](https://www.privacy.org.nz/resources-and-learning/a-z-topics/working-with-third-party-providers/) - [Principle 12: Disclosure outside New Zealand](https://www.privacy.org.nz/privacy-principles/12/) - [IPP 3A: collecting personal information from another source](https://www.privacy.org.nz/resources-and-learning/a-z-topics/ipp3a/) - [Artificial intelligence and the Information Privacy Principles](https://www.privacy.org.nz/assets/New-order/Resources-/Publications/Guidance-resources/AI-Guidance-Resources-/AI-and-the-Information-Privacy-Principles.pdf) Published by Levy Street (https://levystreet.com), Wellington, New Zealand.