26 May 2025
45 Pipitea Street, Thorndon, Wel ington 6011
PO Box 805, Wel ington
Phone: 04 495 7200
Hiria Te Rangi
Email
: [email address]
[FYI request #30601 email]
Website: dia.govt.nz
Tēnā koe Hiria Te Rangi,
Your Official Information Act 1982 request, reference OIA 2425-0696
I am responding to your email of 1 April 2025 to Statistics New Zealand which was
transferred to the Department of Internal Affairs (the Department) on 28 April 2025. You
requested the fol owing under the Official Information Act 1982 (the Act):
Under the OIA, I request:
1. A list of all government departments storing >50% of citizen data offshore (as
recorded in Stats NZ’s 2023/24 audits).
2. For each department:
- The cloud provider(s) used (e.g., AWS Sydney, Azure US-East).
- Whether contracts guarantee data repatriation during emergencies.
3. Any departmental exemptions granted from data localization policies.
Response to your request
The Department does not have a specific record of the percentage of citizen data stored
offshore. This is because the Department’s focus is on the security status of data and where
data should be held, not what type of data should be held where. The Department also does
not hold this information for other government departments. You wil need to request this
information from each individual agency that is subject to the Act. Contact information for
all agencies can be found at the following link: www.govt.nz/organisations/mail-merge/.
As questions two and three relate to question one, there is also no information in scope of
questions two and three. Therefore, the entirety of your request is refused under 18(e) of
the Act, as the information does not exist.
You may be interested to read the Government’s Cloud First policy, which is located on the
following link
: dns.govt.nz/standards-and-guidance/technology-and-architecture/cloud-
services/cloud-adoption-policy-and-strategy/cabinet-requirement. Cabinet requires government organisations to use public cloud services, when possible, for
information systems. It requires agencies to only store data that is classified as Restricted or
below on public cloud services. For that data that is classified Restricted and above, agencies
are required to store it on cloud only when New Zealand-based data centres are available.
Accessing the Ombudsman
You have the right to seek an investigation and review of my decision by the Office of the
Ombudsman. Information about how to make a complaint is available at
www.ombudsman.parliament.nz or freephone 0800 802 602.
Proactive release
We intend to publish our response to your request on our website at:
www.dia.govt.nz/Official-Information-Act-Requests-2. This letter, with your personal details
removed, will be published in its entirety. Publishing responses increases the availability of
information to the public and is consistent with the Act’s purpose of enabling more effective
participation in the making and administration of laws and policies and promoting the
accountability of Ministers and officials.
Nāku noa, nā
Jeremy Cauchi
Director, Ministerial and Monitoring
