What it means for your software.
Most software decides these things for you: your records sit on a supplier’s servers, under their terms, often in another country, and leaving can be hard. A system you own reverses that. You decide where the data lives, who can reach it, and how it leaves with you.
For many organisations in Aotearoa this carries more weight. Government guidance describes Māori Data Sovereignty as “the right for Māori to collect, own, and choose who uses their data”, and notes that many Māori view data as belonging not just to individuals but to their whānau, hapū and iwi. Read the data.govt.nz guidance for business.
How we design for it.
- Where data lives. In your own account, on your own devices, or with a provider and region you choose, agreed in writing.
- Who can see and change it. Sign-in, roles and permissions defined for each kind of record, with a history of changes where it matters.
- How it leaves. Full exports in open formats, and a plan for what happens to the data if the system is retired.
- No secondary use. Your data isn’t used to train AI models or shared for analytics without explicit permission.
- Governance first. Where data belongs to people or communities, the people with authority over it decide how it is used, and the system is built to follow those decisions.
Owned data, in our own work.
Invoices and FitFam keep everything on the user’s own device. There is no account to create and no MindLabs server holding the records. Backups are files the owner saves and restores themselves.
Not every system can work that way, since teams often need shared records. The same principle still applies: the data sits where you decide, under your control, and you can take it with you.
The law sets a floor, not a ceiling.
Under the Privacy Act 2020, Information Privacy Principle 12 sets rules for disclosing personal information to organisations outside New Zealand: the business sending it must have reasonable grounds to believe it will be protected by comparable safeguards. Using an overseas cloud service only to store information on your behalf can be treated differently, so check the Privacy Commissioner’s guidance for your situation. Read Principle 12.
Sovereignty asks more than compliance: not just “is it allowed?”, but “who should decide?”. This is general information, not legal advice.