Hosting your NZ business data in Europe: Privacy Act 2020 and IPP 12
A practical guide for New Zealand businesses, developers and agencies deciding where to host customer data. Status as of 30.09.2026. This is general information, not legal advice.
Short answer
- 1The Privacy Act 2020 governs how New Zealand agencies handle personal information, and the Office of the Privacy Commissioner (OPC) publishes the guidance.
- 2Information privacy principle 12 (IPP 12) covers disclosing personal information to an overseas recipient: the recipient must, for example, be subject to the Privacy Act, or be bound by comparable safeguards, or you need the person's informed permission.
- 3According to the OPC, when a cloud provider only holds or processes information for you as your agent, you will in most circumstances remain responsible for that information, and IPP 12 does not normally call for a separate agreement with the provider.
- 4Storing data on a server in Frankfurt is therefore mainly a question of your own responsibility, contract and security, not a question of a ban.
- 54hosting does not certify legal compliance. Check your case with an adviser or the OPC.
What the OPC says about IPP 12, and what we could not verify
IPP 12. According to the OPC's page on IPP 12, before an agency discloses personal information to an overseas organisation, it must be satisfied that the recipient is subject to the Privacy Act, or is in a country with privacy laws that provide comparable safeguards, or is bound by agreements such as model contract clauses, or takes part in a prescribed scheme. If none of these applies, the agency may disclose only with the person's permission, after telling them that their information may not be given the same protection as the New Zealand Privacy Act provides.
Cloud storage. The OPC's guidance on disclosing information outside New Zealand explains that a cloud provider is treated as your agent when it holds information for safe custody or processing and does not use it for its own purposes. In that case you will, in most circumstances, remain responsible for the information you put on its servers, and IPP 12 does not normally require a separate agreement with the provider. If the provider uses or discloses the data for its own purposes, responsibility can become shared.
What we did not do. The Act on legislation.govt.nz refused our automated download, so we did not read its text ourselves and give no section numbers beyond those in the OPC pages. We also make no statement about whether the EU is treated as having comparable safeguards, and none about any adequacy decision. Check the current OPC guidance and the Act itself before you rely on this page.
Real-world examples
Auckland SaaS start-up with European customers
A software company stores its customer database on a VPS in Frankfurt. It keeps a written processing contract with the host, documents where the data sits, and updates its privacy statement to say so.
Wellington agency hosting client sites
An agency runs several client websites on one cPanel account. It agrees in writing with each client who is responsible for the visitor data, and keeps backups that it tests.
Christchurch online shop
A shop keeps orders and contact details on an EU server. It restricts access to named staff, uses two-factor login, and knows who to call if something goes wrong.
Common mistakes
- Assuming that an overseas server automatically breaks the Privacy Act. The OPC guidance points to who is responsible and what safeguards apply, not to server location alone.
- Assuming the opposite: that responsibility moves to the host. According to the OPC, for a provider acting as your agent you remain responsible.
- Letting a provider use your customers' data for its own purposes without checking what that does to the agent position described by the OPC.
- Having no written contract describing what the host may do with the data.
- Treating security as a one-off setup instead of testing backups, access and updates regularly.
How 4hosting helps
Our datacenter is in the EU, in Frankfurt, not in New Zealand. We say this plainly so you can describe where your data sits. We offer a data processing agreement (DPA) under GDPR Article 28 and standard contractual clauses for transfers. Whether these documents satisfy IPP 12 for your business is a question for you and your adviser.
Every plan includes monthly DevOps, CyberSecurity and Programming hours (from cPanel Advanced upwards; VPS plans include 1 to 8 hours). You can use them for server hardening, backups, access control and WAF rules. Hours are requested from the client panel and do not carry over; work beyond the included hours is accepted and billed separately. 4hosting is not a compliance certifier and does not sign legal compliance for you. Migration is free. Support is in English and Romanian. Billing is in EUR.
Frequently asked questions
Is it lawful to host New Zealand personal information in the EU?
The OPC guidance does not ban overseas storage. It sets out when IPP 12 applies and says that for a cloud provider acting as your agent you remain responsible. We did not read the Act itself, so check your specific case with a New Zealand privacy adviser or the OPC.
Where are 4hosting servers?
In the EU: Frankfurt, with points of presence in Frankfurt, London and New York. There are no 4hosting datacenters in New Zealand.
Does 4hosting make me compliant with the Privacy Act 2020?
No. 4hosting is not a compliance certifier and holds no ISO, SOC 2 or similar certification; we describe our security practice as aligned with ISO 27001. We offer a data processing agreement (DPA) under GDPR Article 28 and standard contractual clauses. We do not claim that these are recognised as the OPC's model contract clauses. Compliance of your processing remains your responsibility.