Where is it stored?
- Which country, which provider, and which region are the servers in?
- Where are backups kept, and for how long?
- Can you choose the location?
Who can see it?
- Who at the supplier can access your records, and when?
- Is support access logged, and can you see that log?
- Which other companies process your data for them?
How do you get it out?
- Can you export everything, in an open format, at any time?
- Is there a fee or a delay?
- When you leave, is your data deleted, and can they confirm it?
What else is it used for?
- Is your data used to train AI models, theirs or anyone else’s?
- Is it used for analytics, benchmarking or marketing?
- Can you switch those uses off, in writing?
If you hold Māori data.
Government guidance describes Māori data as information “about or from Māori people, language, culture, resources, or environments”, and encourages businesses to identify it, set clear boundaries on its use, seek informed consent, and avoid using it for AI training without explicit permission. See how we design for data sovereignty, and read the data.govt.nz guidance.
What the law covers.
The Privacy Act 2020’s Principle 12 sets rules for disclosing personal information outside New Zealand. Storing it with an overseas provider on your behalf can be treated differently. Check the Privacy Commissioner’s guidance for your situation. This guide is general information, not legal advice.