Hosting a New Zealand website

Hosting used to be a simple question for New Zealand businesses, because the honest answer was Sydney. That changed recently and quietly. Microsoft opened its New Zealand North region in Auckland in December 2024, and Amazon Web Services opened its Asia Pacific New Zealand region in September 2025. For the first time, hyperscale infrastructure sits on New Zealand soil, and the trade-offs are worth revisiting.

What is actually available on shore

Alongside the hyperscalers there is a long-established New Zealand hosting industry. Catalyst Cloud operates regions in Porirua and Hamilton, holds ISO 27001 and ISO 27017 certification, and is an approved cloud provider to the New Zealand Government. Datacom, majority New Zealand owned with a substantial stake held by the New Zealand Superannuation Fund, runs data centres in Auckland, Christchurch, and Hamilton. SiteHost has run its own Auckland facility since 2018. These are genuine options rather than consolation prizes, and for a business that wants a named local company answering the phone they are often the better fit.

The latency case, with actual numbers

This is the part of the argument that survives scrutiny. Microsoft publishes measured round-trip latency between its regions, sampled continuously and reported at the median. From Auckland, the figures are unambiguous: about 28 milliseconds to Sydney, about 39 to Melbourne, roughly 133 to 138 to the United States west coast, and roughly 245 to 270 to Europe. Those are network times before your server does any work at all.

The practical effect depends on how chatty your site is. A single round trip difference of 100 milliseconds is barely perceptible. A page that makes ten sequential round trips before it can render, which is entirely normal for a database-driven site with third-party scripts, turns that into a full second. This is why hosting location matters far more for traditional server-rendered sites than for static ones, and it is the single strongest argument for moving off distant hosting.

New Zealand is well connected, which is why this is not the whole story

Three major submarine cable systems serve the country. The Southern Cross Cable Network has run since 2000 and lands at Whenuapai and Takapuna in Auckland. Southern Cross NEXT entered service in July 2022, adding substantial capacity on the Sydney to Auckland to Los Angeles route. The Hawaiki cable, in service since 2018, connects New Zealand to Australia and the United States, and the Tasman Global Access cable has linked Raglan to Sydney since 2017. Combined capacity across these systems is large and growing. Connectivity is not New Zealand's bottleneck, which is worth knowing before paying a premium to solve a problem you may not have.

A content delivery network changes the calculation entirely

For most business websites, the hosting location debate is less important than it sounds, because a content delivery network makes the origin server's location largely irrelevant to visitors. A statically generated site distributed across a global edge network is served from a location near the visitor regardless of where it was built or where its origin lives. That is the architecture we use by default, and it is why a New Zealand visitor and a London visitor both get a fast page without anyone choosing between them. Origin location matters most when every request must reach the origin, which is the case for database-driven sites and for anything doing real work per request.

What the Privacy Act actually says about offshore hosting

Information Privacy Principle 12 of the Privacy Act 2020 governs disclosing personal information to a foreign person or entity. It permits cross-border disclosure where the individual has given informed consent, where the recipient carries on business in New Zealand, where the recipient is subject to comparable privacy laws, where a prescribed binding scheme applies, or where contractual safeguards provide comparable protection. That is a set of conditions, not a prohibition, and standard cloud arrangements are routinely structured to satisfy them.

There is a further nuance worth taking advice on rather than taking from a web page. The generally understood position is that giving personal information to an overseas provider that merely stores or processes it on your behalf, which is what ordinary hosting is, is treated differently from disclosing it to that provider, because you are still regarded as holding the information. What is not in doubt is the practical consequence: you remain accountable under the Privacy Act for how your provider handles the data, wherever it sits. Choosing New Zealand hosting removes the cross-border question entirely, which is a legitimate reason to prefer it even though it is not a legal requirement.

Government and public sector rules are genuinely different

If you are a public sector organisation, none of the above is the whole picture. The Government's Cloud First policy requires agencies to use public cloud services in preference to traditional infrastructure, and to seek approval from the Government Chief Digital Officer before investing in on-premise infrastructure, which is the opposite of the restriction people often assume. Data classified RESTRICTED or below may be held in public cloud, on shore or offshore, subject to a jurisdictional risk assessment, with a stated preference that RESTRICTED information move to New Zealand based data centres over time where a suitable service exists. Only two of the all-of-government cloud framework agreements are with New Zealand owned providers, Catalyst Cloud and Datacom.

Maori data sovereignty is a real consideration, and a different one

Guidance in the health and research sectors holds that data about Maori should, wherever possible, be stored in Aotearoa New Zealand, on the basis that decisions about storage should preserve control for current and future generations. This is a governance principle rather than a statutory requirement, and it is not satisfied by choosing a data centre address alone, since it concerns who holds decision rights over the data. If your organisation holds significant Maori data, this deserves engagement rather than a hosting decision made on your behalf by a web studio.

How to actually decide

1. 01If your site is a marketing or brochure site with no personal data beyond enquiry forms, host it wherever it is fastest and cheapest, and put a content delivery network in front of it. The sovereignty question does not meaningfully arise.
2. 02If your site is database-driven and your visitors are overwhelmingly in New Zealand, onshore hosting is worth the money for the latency alone. The saving over United States hosting is over 100 milliseconds per round trip.
3. 03If you hold sensitive personal information, onshore hosting removes a category of privacy analysis rather than a legal barrier. That simplification has genuine value even though it is not compulsory.
4. 04If you are a public sector organisation, start with the Cloud First policy and the jurisdictional risk guidance on digital.govt.nz, not with a hosting provider's sales page.
5. 05If you hold significant Maori data, treat storage location as a governance conversation rather than a procurement decision.
6. 06In every case, make sure the hosting account is in your name and you can leave. That matters more in practice than the country it sits in.