2026 New Zealands Digital Identity landscape is increasingly reliant on Cloud infrastructure provided by US based companies thus raising  significant concerns regarding as to ‘Data Sovereignty’.  While Data Residency refers simply to the physical location of servers,- Data Sovereignty is about the legal control over that data. Even if Data is stored locally it may still be subject to foreign laws if managed by a foreign provider (Like  the US CLOUD Act)

Cloud Infrastructure and US Jurisdiction:- Key Provider – Backend databases and authentication systems for flagship govt Identity Services, such as ‘Govt.nz.app and ‘NZ Verify’ are primarily run on Microsoft Azure and Amazon Web Services (AWS). As the the impact of the US CLOUD Act, even when data is stored locally in New Zealand (as in the case of AWS) the COUD Act allows the US Govt to compel these US companies to disclose electronic data under their control, regardless of where that data is physically stored.

The long standing ‘Real Me’  authentication system already stores ‘Login data’ offshore in Microsoft’s Azure Cloud making New Zealand one of the first countries ito store citizen authentication data in a public cloud subject to ‘foreign jurisdiction’

The Regulatory & Strategic Context for 2026: The Digital Identity Services Trust Framework (DISTF) became fully operational with new rules on July 24th 2025, that regulates Identity Services but does NOT mandate Local Ownership of Infrastructure. It focuses on Encryption and User Consent, with Credentials often residing on the Users Device.

The NZ Government Cloud First Policy: Despite Jurisdiction risks, the NZ Govt maintains a ‘CLOUD First Policy’, requiring agencies to adopt public Cloud Services over on premise infrastructure for productivity and cost reasons  Digital Identity New Zealand (DINZ) has identified ‘Sovereign Data Infrastructure’ as a Major Initiative for 2025- 2026, aiming to align the Data Ecosystem with Te Ao Maori Data Sovereignty Principles

Existing infrastructure as a Service (Iaas) and Telecommunications as a Service (Taas) agreements  were set to expire at the end of last year (2025), with the Dept of Internal Affairs (DIA) last year  already developing replacements. Data Sovereignty is not just about Server Location but also importantly about Legal Authority. When NZ Data sits on US Infrastructure- US Law can act as a Final  Authority in conflicts thus potentially overriding NZ Legal Protections

There is ongoing debate over Maori Data Governance, as to whether the Crown (The abstract Crown=Govt) is meeting its obligations to protect data as a taonga (treasure) under Tiriti o Waitangi by using foreign owned infrastructure that bypasses Maori Data Governance requirements. Surely every New Zealander Personal Data is a  Personal Treasure. This  Digital Imprisonment of NZrs Data collection should not be happening in the first place. (Again more identity Politics thrown into the mix)

NZ Government (Judith Collins Portfolio) of Digital Identification systems  raises significant concerns that requires open public debate that includes all citizens (New Zealanders) We are only being told what they want us to hear..  US authorities can compel disclosure of NZ Data which seriously. Significantly impacts on our Privacy and Security. This is of National Interest involves ALL New Zealanders.

This creates a jurisdictional risk, as NZ Laws do not fully protect data from foreign government access. Apart from this the Government cannot guarantee they will protect your personal information through their Digital ID System. The Bigger the Data collected and stored – cyber attacks-Hacks will have a much more impact on the security of NZrs personal info, which can actually be sold on the Net

The AWS stores Data in Data Centers, the parent company remains under US Jurisdiction which allows for Data Requests. So weighing it up, does NZ Data really have NZ Data Sovereignty ? (I think Not) Then I am not a  Digital expert on these matters, I am merely a Researcher wanting  to get the truth out there into the public space. From my own personal point of view I believe this whole thing about keeping NZrs Safe whether on the Net – Digital ID- Lockdowns-Shutdowns Restrictions etc., is about Keeping New Zealanders controlled. NZ Government cannot guarantee  the safety of your personal info through theirs or any other Digital Identity System

WakeUpNZ

RESEARCHER: Cassie