--- title: "Māori Data Jurisdiction: Myths, Risks & Hosting Analysis" description: Māori data sovereignty principle of jurisdiction, the myths about NZ cloud hosting, and where iwi and Māori groups actually host their data. url: https://www.taiuru.co.nz/2024/08/jurisdictional-maori-data-sovereignty/ markdown_url: https://www.taiuru.co.nz/2024/08/jurisdictional-maori-data-sovereignty.md type: post slug: jurisdictional-maori-data-sovereignty author: Karaitiana Taiuru published: 2024-08-11T04:49:48Z modified: 2026-10-10T04:49:02Z language: en-NZ taxonomies: category: - AI Governance - Māori Data Sovereignty and Governance word_count: 2980 tokens: 4772 --- # Māori Data Jurisdiction: Myths, Risks & Hosting Analysis Māori Data Jurisdiction: What the Principle Means, the Cloud Hosting Myths, and Where Māori Data Is Actually Hosted By Dr Karaitiana Taiuru. First published 11 August 2024; combined with “Māori Data Jurisdiction” (26 November 2024) and updated 10 October 2026. Hosting findings are a snapshot as at 26 November 2024. Key facts at a glance The principle: jurisdiction is one of the six Māori data sovereignty principles. It means storing Māori data in Aotearoa New Zealand where appropriate, with the strongest case for tapu data such as genetic and health information. Legal footing: the Waitangi Tribunal’s Wai 2522 report on the CPTPP found that governance of Māori data goes to the heart of Māori identity and that mātauranga Māori is a taonga the Crown must actively protect. Hosting in New Zealand is not full sovereignty: onshore data remains subject to New Zealand law, trade agreements and the Budapest Convention on Cybercrime. The overseas risk is small: in July–December 2022 Microsoft received 9 New Zealand law enforcement requests out of 24,738 internationally, and disclosed no content. Local providers get far more requests: Spark received 1,837 requests in the same period and fully supplied data in 1,101. Myth busted: New Zealand does not have only one data centre. Data Centre Map listed 52 public data centres in 2024 and 64 by October 2026. In practice: in November 2024 only 6 of 85 active iwi hosted both website and email in New Zealand, and only 1 of 12 Māori data sovereignty advocates did. What is the jurisdiction principle? Jurisdiction is one of the six Māori data sovereignty principles. It holds that Māori data should be stored in Aotearoa New Zealand when appropriate. Jurisdiction needs particular consideration for tapu data: genetic, personal health and other private information, and any other data that Māori collectives deem tapu. The principle has legal weight. In its report on the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (Wai 2522), released in pre-publication form in November 2021 (the downloadable report is dated March 2023), the Waitangi Tribunal found that the CPTPP’s e-commerce rules breached the Crown’s duty of active protection of mātauranga Māori. It treated the governance and control of Māori data as central to that finding because data goes to matters fundamental to Māori identity, such as whakapapa, mana, mauri and mātauranga. I read this as recognising that Māori data is a taonga subject to Māori data governance. Decisions about where Māori data lives are therefore Te Tiriti o Waitangi matters, not just technical or procurement choices. Case study: Te Tumu Paeroa and Microsoft (May 2024) On 7 May 2024, Te Tumu Paeroa and Microsoft announced a cloud agreement that Te Ao Māori News described as groundbreaking (Te Ao Māori News; Microsoft). Te Tumu Paeroa’s publicly accessible data, and its landowners’ login-restricted data, currently held both offshore and in New Zealand, will be moved to New Zealand-based Azure servers. Based on media reports and correspondence, the arrangement includes a sovereign encryption key, and Microsoft agreed that customary Māori protocols and tikanga could be carried out. Te Tumu Paeroa’s move is guided by its own Māori data sovereignty framework. The headline caused disinformation and confusion among some Māori data advocates. Some dismissed the deal as not progress and not Māori data sovereignty. Others argued that jurisdictional problems remain because the United States CLOUD Act can compel US-owned companies to comply with US government disclosure and takedown requests. In my view the deal demonstrates that Māori data is treated as a taonga: it allows tikanga and repatriation, and it is a practical exercise of rangatiratanga by a Māori kaitiaki of data. A precedent: the repatriation of mokomokai Māori have long repatriated mokomokai and other ancestral remains from overseas museums to Te Papa. Once home, the remains are held under New Zealand law and Te Papa’s governance, while Māori exercise rangatiratanga over them. When their marae, hapū or iwi are identified, the remains are offered back for culturally appropriate disposal. Te Tumu Paeroa’s data repatriation follows the same pattern, with Māori data governance respected. Bringing the data home first will make a later transfer to Māori- or iwi-controlled servers far easier once those exist. Hosting overseas versus in New Zealand: does local hosting equal sovereignty? Both Microsoft (Microsoft Cloud for Sovereignty, generally available from 14 December 2023) and Amazon Web Services now offer encryption and data sovereignty features in their cloud services. I discussed the Te Tumu Paeroa deal and Māori data sovereignty with Associate Professor Gehan Gunasekara, a commercial law academic, on a Newsroom podcast published on 9 August 2024. Storing data in New Zealand does not by itself deliver full sovereignty: Domestic law still applies. The 2012 raid on Kim Dotcom and the 2007 Urewera “terrorism” raids show that New Zealand authorities can reach data and act against communities held within New Zealand’s jurisdiction. International agreements apply onshore. New Zealand acceded to the Budapest Convention on Cybercrime on 28 August 2025, and it came into force for New Zealand on 1 December 2025. Māori, including myself, were consulted, but it remains an international agreement governing cross-border access to data. Trade agreements and other treaties bind the New Zealand Government, as Wai 2522 itself examined. The CLOUD Act cuts both ways. The US Clarifying Lawful Overseas Use of Data Act allows the US government to seek data held by US-based providers wherever it is stored. Amazon states that the Act does not change existing legal and privacy protections, that it objects to overbroad requests, and that no enterprise or government content located outside the US has been disclosed to the US government. How often are law enforcement requests made for data? Microsoft states that it shares customer data only when the customer authorises it or the law requires it, and that it gives no government unfettered access. Provider transparency reports show how rarely New Zealand data held offshore is requested, and how often local providers receive requests. Provider Period Requests Outcome Microsoft (worldwide) Jul–Dec 2022 24,738 769 partial disclosures; 15,012 for subscriber or non-content data only; 5,760 declined Microsoft (New Zealand) Jul–Dec 2022 9 (15 accounts) 0 content disclosed; 4 some data provided; 5 declined for not meeting local requirements Amazon As reported by Amazon 26,972 117 from countries other than the US, France, Germany, India, Italy, Spain, Turkey and the UK Amazon Web Services As reported by Amazon 954 80 from countries other than those listed above Spark (New Zealand) Jul–Dec 2022 1,837 from more than 12 agencies 1,101 fully supplied; 321 partially; 415 not supplied. Largest requesters: NZ Police (1,245), Coronial Services (391) One NZ and 2degrees — Not published Both privacy policies state customer data may be shared with law enforcement on request The 4 New Zealand requests where Microsoft provided some data amount to about 0.016% of its 24,738 international requests for the period. Spark, a New Zealand provider, received 1,837 requests and fully supplied data in most of them. Spark’s request numbers have stayed in the same range since: it received 1,616 requests in January–June 2026, fully supplying 1,360. Myth: “New Zealand has only one data centre” This is false. In 2024 Data Centre Map listed 52 public data centres in New Zealand; by October 2026 it listed 64. Spark, One NZ and 2degrees all operate New Zealand data centres, and many New Zealand companies rent server space and offer email, web hosting and software as a service (SaaS). Many New Zealand and Māori-owned providers offer local hosting, open-source options and sovereign servers. Several wholly or majority Māori-owned or Māori-directed organisations offer New Zealand sovereign servers, some marae use sovereign servers as archival repositories, and another Māori-owned company offers blockchain technology to Māori groups on sovereign servers. Even so, sovereign servers still rely on national and international Internet links and remain subject to New Zealand law and treaties. See also my research on Māori and iwi investments in data centres in Aotearoa New Zealand. Where is Māori data actually hosted? November 2024 analysis First published 26 November 2024. Findings are accurate as at that date and may have changed since. This analysis follows my earlier work on data jurisdiction. It shows that most Māori, including individuals, whānau, hapū, marae, Māori tech companies and iwi, do not treat privacy, jurisdiction, Māori domain branding or consent for email and web data as issues. Most Māori groups prefer international servers and overlook both the Māori data sovereignty principles and New Zealand legal protections. That includes prominent Māori data sovereignty advisers to government, most iwi and most self-described sovereignty advocates. I have run this test annually since 2018, and the pattern has held. In my view, some of the original principles, including jurisdiction as first framed, are less relevant than they once were. Methodology Tools: publicly available IP and DNS lookup tools were used to check IP addresses, hosting jurisdiction and MX (email) records, cross-referenced with private tools. Exclusions: contact forms were not assessed because of technical and tikanga complexities; they are left for future research. Sample: groups were chosen to give a cross-section of Māori rights organisations. Iwi: the .iwi.nz registration list (last updated early 2024), with expired domains and domains without an active website or email server removed, leaving 85 active iwi. Māori data sovereignty advocates and experts: 12 organisations or individuals outside academia with their own websites who publicly identify as Māori data or data sovereignty advocates or experts. One is an individual employed by a New Zealand company; employers were excluded unless the person advocates publicly outside their work. Māori advocacy organisations: 4 national organisations: Te Pāti Māori, a national Māori health provider, the Māori Women’s Welfare League and Te Kōhanga Reo National Trust. Māori tech companies: 36 companies. From Mapping the Māori Tech Sector, 17 of 30 listed leaders were used (13 academics or international IT executives were removed). From the 2023 Toi Hangarau report, which counted 85 Māori-owned tech companies and profiled 25, 19 unique companies were used. I estimate the 36 represent about 59% of identified Māori tech companies. Māori businesses: 100 businesses randomly sampled from two online Māori business directories. Wānanga: all 3 wānanga. Scoring system (maximum 3 points) 1 point for a .nz domain registered with a New Zealand company using New Zealand servers. A .nz domain registered through an overseas company or on overseas servers scores 0. 1 point for a website hosted on a New Zealand server. 1 point for an email server based in New Zealand (no email server scores 0). Key findings Group Sample Result Māori data sovereignty advocates and experts 12 8 had .nz domains registered with NZ companies (3 .maori.nz); 2 had NZ email; only 1 hosted both website and email in NZ Iwi (.iwi.nz) 85 62 scored 1/3 (website and email overseas); 17 scored 2/3 (website in NZ, email overseas); 6 scored 3/3 Māori tech companies 36 15 scored 0/3; 16 scored 1/3; 4 scored 2/3; 1 scored 3/3 Māori businesses 100 10 fully hosted in NZ with .nz domains; 40 used non-.nz domains Māori advocacy organisations 4 3 .nz domains, 1 .com; all 4 used international hosts for website and email Wānanga 3 2 .ac.nz domains, 1 non-.nz; none hosted website or email in NZ Māori data sovereignty advocates and experts Of the 12, 8 used .nz domains registered with New Zealand companies, and 3 of those were .maori.nz (Te Mana Raraunga, a self-proclaimed Māori government, and Taiuru & Associates). Only 2 had New Zealand-based email, and only one, Taiuru & Associates (taiuru.maori.nz), hosted both its website and email in New Zealand, scoring 3/3. Te Mana Raraunga, which created the original Māori data sovereignty principles, scored 1/3. Its domain is registered to an individual rather than the organisation, and its website and email are hosted overseas. Te Kāhui Raraunga, an iwi data advocacy group with government agreements, scored 0/3. Its Te Whata statistics site was designed by a non-Māori company (Octave) and is hosted in the United States on a non-.nz domain. The Kīngitanga and a self-proclaimed Māori government each scored 0/3. Te Hiku Media responded that it is doing good work even though its email is not hosted in New Zealand, and that real data sovereignty practitioners focus on community storytelling rather than mail servers. Iwi Of the 85 iwi with active .iwi.nz websites or email, 62 hosted both website and email overseas and scored only for their domain. 17 hosted their website in New Zealand but used overseas email. 6 hosted both in New Zealand, and only 3 of those did so on non-proprietary servers. Māori tech companies 21 of the 36 used .nz domains (12 .co.nz, 6 .nz, 2 .org.nz and 1 .maori.nz); 15 used international or non-.nz domains, and none used .kiwi. Tech companies were more likely than other groups to use large cloud email providers with Australian data centres. All 15 companies scoring 0/3 used international or non-.nz domains, and only 1 company hosted everything in New Zealand. Lee Timutimu thanked me for the research, said it had prompted him to review his own domain and hosting, and committed to walking the talk. Māori businesses Only 10 of 100 Māori businesses (10%) were fully compliant, with a .nz domain, New Zealand-hosted website and New Zealand-hosted email. 40 did not use a .nz domain, and businesses preferred .nz and .co.nz over .maori.nz. The chief executive of NZTech described the research as useful for decision-making and noted the tension between ideals and pragmatism. Māori advocacy organisations and wānanga All four national Māori advocacy organisations used international hosting for website and email; three used .nz domains and one a .com. None of the three wānanga hosted its website or email in New Zealand; two used .ac.nz domains and one a non-.nz domain. Why the gap between principle and practice? The Māori data sovereignty principles have been promoted for nearly a decade, and Wai 2522 has recognised the importance of Māori data. Yet most Māori, and all but one Māori data sovereignty expert, do not apply the jurisdiction principle or rely on New Zealand legal protections such as privacy law. Jurisdiction mattered more when the principles were drafted. Encryption, sovereign key options and modern cloud hosting have changed the picture. My earlier research found the feared US CLOUD Act is not realistically a genuine threat, putting the probability of a New Zealander’s data being sought under it at about 0.007%, and other legal routes to obtain data are also rarely used. The likely reasons for overseas hosting are the marketing reach of international hosts, cost, ease of use, and the lack of New Zealand data centre marketing to small businesses, iwi and community groups. The most obvious factor is that US hosts are cost-effective and offer easy control panels that need little technical skill. Disclose where your data is stored Whatever choice an organisation makes, it should be transparent. I recommend every Māori organisation publish a Māori data sovereignty statement on its website that says where its data, website and email are stored. Taiuru.co.nz carries a Māori Data Sovereignty Statement on every page, and in August 2024 I was migrating this site to a leased New Zealand server. You can check the country and city where a website is hosted with a free tool such as the Site24x7 website location finder. Conclusion Māori data sovereignty principles are spreading across government, contracts and academia. Some self-described experts lack adequate knowledge of te ao Māori, governance or the Internet, and their misinformation can stall progress. The principles are aspirational guides for working with data providers in partnership under Te Tiriti o Waitangi. They are not absolute rules. Māori, hapū, iwi and hāpori Māori decide which of their data is tapu and needs a higher threshold, including storage in, or repatriation to, Aotearoa New Zealand. Each kaitiaki should exercise its own rangatiratanga, as Te Tumu Paeroa did, with a holistic Māori worldview. New Zealand-owned hosting and open-source software are worthy aspirations but are not always viable. The highest aspiration, a fully Māori-owned data hosting company in New Zealand running its own custom servers, is unlikely in the foreseeable future. Some legal jurisdiction will always apply. Until then, Māori groups must weigh the very small chance of their data being shared with law enforcement against the principles, costs and security that large cloud providers offer, and be open about the choice they make. Frequently asked questions What is the jurisdiction principle in Māori data sovereignty? It is the principle that Māori data should be stored in Aotearoa New Zealand where appropriate, especially tapu data such as genetic and health information. Does storing Māori data in New Zealand guarantee sovereignty? No. Onshore data remains subject to New Zealand law, trade agreements and the Budapest Convention on Cybercrime. How likely is it that an overseas cloud provider hands New Zealand data to law enforcement? Low. In July–December 2022 Microsoft received 9 New Zealand requests, disclosed no content, and provided some data in 4 cases, about 0.016% of its international requests. My earlier research put the CLOUD Act risk for New Zealanders at about 0.007%. Does New Zealand only have one data centre? No. Data Centre Map listed 52 public data centres in New Zealand in 2024 and 64 by October 2026, and Māori-owned sovereign hosting options exist. Where do iwi host their websites and email? Mostly overseas. In November 2024, 62 of 85 active iwi hosted both website and email overseas, and only 6 hosted both in New Zealand. Related reading Compendium of Māori Data Sovereignty (Version 2) Māori and iwi investments in data centres in Aotearoa New Zealand Tikanga Tawhito, Tikanga Hou: guidelines for DNA research and storage Te Tiriti and Māori Ethics Guidelines for AI, Algorithms, Data and IOT (2020) Māori data governance in 2025 Analysis and directory of Māori ICT groups Tikanga Tawhito, Tikanga Hou: literature reviews Original posts consolidated here Jurisdictional Māori Data Sovereignty (11 August 2024) Māori Data Jurisdiction (26 November 2024)