Can my business use overseas cloud services under the Privacy Act?

The key question

Does the provider use your data for its own purposes?

• No, it just stores and processes it for you under contract. Section 11 applies. The information is treated as held by you. This covers typical email, file storage, accounting, CRM and backup services.
• Yes, for example it trains AI models on your data, builds profiles or uses it for analytics of its own. That’s a disclosure. If the provider is overseas, principle 12 applies, and you need one of its grounds, such as the provider being subject to comparable privacy safeguards, or the person authorising it after being told the risks.

Free services and AI tools are where this most often goes wrong. Read the contract terms themselves, because marketing pages often leave out where data is stored and who can use it.

What you’re still responsible for

• Security. Principle 5 requires reasonable safeguards. Choose reputable providers, turn on multi-factor authentication, limit access, and review sharing settings.
• Breaches. If your provider is breached, it’s your breach to assess and, if notifiable, to report.
• Access and correction requests. You need to be able to find and provide information held in the cloud within 20 working days.
• Telling people. Say in your privacy statement that you use service providers, including overseas ones, to store information.

What to check before you sign

• Where is data stored and processed?
• Does the provider use your data for anything of its own, including AI training? Can you turn it off?
• What security certifications does it hold?
• How fast will it tell you about a breach?
• How do you get your data out, and how is it deleted when you leave?

Māori data

Some iwi and Māori organisations prefer or expect data to be stored in Aotearoa. If you hold Māori data, discuss storage location with the people it’s about. See Māori data and privacy.