Control risks
Agencies are not released from their obligation to obey New Zealand law and policy because they have outsourced data or operations to contractors in New Zealand or beyond.
Digital information created as part of an agency's functions is part of the public record to which the Public Records Act 2005 applies. Agencies are also responsible for their handling of personal information under the Privacy Act 1993.
It is important that government maintains control over its information and how it is accessed and used, whether hosted within or beyond its jurisdiction. Offshore hosting of government information poses a risk of loss of control over such information. Particular care should be taken when agreeing to standard terms and conditions, to ensure that they do not have the effect of the agency either losing control of its data (e.g., through an assignment of copyright) or granting an exclusive or otherwise inappropriately broad licence to the service provider.
Control risks
- Loss of control over data
- Loss of control over supplier or sub-contractor performance
- Loss of control over service delivery because of unreliable foreign national/international infrastructure
- Inadequate management of information and records created as part of government functions
- Loss of information or records due to non-recovery or lack of authorised disposal following end of contract
Example mitigations
- Seek appropriate legal advice
- Investigate the scope and powers of foreign legislation over New Zealand data and services and offshore support personnel and providers
- Specify requirements for the creation and maintenance of information and records in contracts
- Specify contractual agreements on recovery or disposal of information at the close of a contract
- Avoid offshoring private or sensitive data or services (including remote support) where assurance over the confidentiality of data cannot be assured.
- Limit scope for further outsourcing by the service provider
- Contract and test for redundancy and business continuity
