Datacom finds NZ firms untested on outage recovery

Datacom has found that many New Zealand organisations are confident they can withstand a network or cloud disruption, despite limited recent testing of their recovery plans. The findings are based on a survey of 155 senior business and technology leaders in New Zealand.

Its annual Data Sovereignty Report points to a gap between concern about data control and the practical steps needed to restore systems and services if access is interrupted. While 85% of respondents said they were confident they could keep critical services running through a disruption, only 39% had tested their ability to restore critical systems and data in the past six months.

Another 13% had never tested their recovery arrangements. At the same time, 79% described their backup strategy as mature, suggesting confidence in resilience may be outpacing operational checks.

Policy gap

Only 35% of organisations had a formal written policy governing where critical data should be stored and managed. More than half, 55%, did not have such a policy.

The divide was sharper among smaller businesses. Among organisations with fewer than 20 employees, just 7% had a formal policy on where critical data was stored, compared with 70% of organisations with 20 or more employees.

Concern about offshore storage remains widespread. Eighty-three per cent of respondents said they were concerned about storing data offshore or with an overseas provider. Of that group, 77% cited data breaches and 60% pointed to legal access by foreign governments.

Peter Nelson, Managing Director, Datacom New Zealand, said the results showed awareness alone was not enough. "Organisations are paying much closer attention to where their critical data sits, who controls the infrastructure it relies on and what would happen if access were disrupted. The challenge is turning that awareness into practical action. Resilience comes from having clear policies, tested recovery plans and a realistic understanding of how the business would respond during an outage or disruption."

Storage choices

Most respondents said their most sensitive or business-critical data was stored domestically. Sixty-four per cent used an entirely local model, while 21% used a mix of New Zealand and offshore storage.

Even when data is held locally, overseas groups still play a major role in the underlying infrastructure. Among organisations using local or hybrid storage, 56% said their data was hosted in data centres operated by hyperscale providers such as AWS, Microsoft Azure or Google.

That distinction appears to matter to many decision-makers. More than half of leaders, 56%, said they were concerned foreign governments could access data stored in New Zealand if the infrastructure was owned by a multinational provider.

Although 72% of respondents said ownership and control of data was an important or critical priority, cost and scalability remained the biggest drivers of storage decisions for 39%. That compared with 16% who were mainly influenced by regulatory or compliance requirements and 10% who prioritised jurisdiction and control.

Recovery plans

The report also examined what businesses would do if their main provider became unavailable or no longer suitable. Only 41% said they had a documented exit or migration plan in place.

Nelson said testing was central to any resilience strategy. "A backup strategy is only as good as an organisation's ability to restore from it when something goes wrong. Businesses need to know how quickly they can recover, whether critical systems will keep operating and what options they have if a provider or network route suddenly becomes unavailable."

He added that disruption could quickly affect day-to-day life beyond the IT function. "For New Zealanders, a major network outage can mean far more than a temporary inconvenience. It can affect how people access essential services, how businesses take payments, how supply chains operate and how communities stay connected during critical moments. These examples highlight why organisations need to be ready to respond quickly, minimise disruption and restore normal operations as soon as possible."

AI pressure

Data infrastructure decisions are also being shaped by artificial intelligence. Almost half of respondents, 45%, said AI adoption had already influenced their storage and infrastructure choices over the past year.

Yet 43% said legacy systems, fragmented data platforms or unclear governance were slowing their ability to adopt AI safely. More than a third, 37%, said their organisation was already reviewing where critical data was stored and managed or planned to begin a review within six months.

Lou Compagnone, Director of AI, Datacom, said many organisations were trying to move quickly without fully addressing the underlying condition of their data. "Businesses are pushing ahead with new tools, but legacy systems, fragmented platforms and unclear governance are making it harder to adopt them safely and at scale."

He added: "The organisations that get the most value from AI will be the ones that have done the foundational work first - trusted data, strong governance, clear access controls and confidence in where information is stored and who can access it."

Māori governance

The survey found limited consideration of Te Tiriti o Waitangi and Māori data governance principles in storage decisions. Only 27% of leaders said their organisation always or often considered these principles, while one-quarter said they were never considered.

Larger organisations were more likely to factor them in. Thirty-nine per cent of organisations with 20 or more employees said they always or often considered Māori data governance principles, compared with 18% of smaller organisations.

Support for keeping sensitive information under New Zealand jurisdiction was strongest for government-held and personal data. Seventy-five per cent of respondents said citizen data should remain under New Zealand jurisdiction, followed by tax and financial records at 71% and defence and national security information at 70%.