Software is New Zealand’s most easily exported product — no freight, no customs, no biosecurity. The obligations that arrive instead are less visible and are frequently addressed late.
Data protection is the first constraint
Where your customers are, their data protection law probably applies to you.
The European Union’s regime applies to organisations offering goods or services to people in the EU regardless of where the organisation is established. That brings obligations around lawful basis, data subject rights, breach notification within a short timeframe, and potentially appointing a representative.
Other jurisdictions have their own regimes, and several US states have enacted consumer privacy laws with differing requirements.
New Zealand’s Privacy Act 2020 applies throughout, including the new IPP 3A obligation on indirect collection that came into force on 1 May 2026, and the requirement to ensure comparable protections when sending personal information overseas.
Practical approach: build to the strictest regime you are subject to rather than maintaining separate standards. Retrofitting data protection into a product is considerably more expensive than designing for it.
Data residency
Some customers and some jurisdictions require data to be stored in a particular country. Public sector customers frequently do, and regulated industries often do.
Architecting for multi-region storage after the fact is expensive. If you intend to sell into markets or sectors with residency requirements, consider it early.
Tax presence
Selling software from New Zealand into another country does not usually create a taxable presence there. Several things can:
- People in market — a salesperson or support engineer based overseas, particularly one who can conclude contracts.
- An office or fixed place of business.
- A local entity, which creates obligations by definition.
Double tax agreements determine when a permanent establishment exists. The threshold is lower than most founders assume, and the first offshore hire is a common trigger.
Withholding tax may apply to payments treated as royalties, and whether software licence fees are royalties varies by jurisdiction and agreement. Build it into pricing rather than discovering it when payment arrives short.
Digital services taxes and consumption tax registration obligations apply in a growing number of jurisdictions once sales exceed thresholds. Monitor your revenue by country against those thresholds.
GST on exported services
Exported services can be zero-rated where the recipient is outside New Zealand, subject to conditions and exceptions — particularly where the service relates to land or goods situated here.
Software delivered to an overseas business customer generally zero-rates. Confirm the position for your specific arrangement rather than assuming.
Contract terms that matter when selling offshore
- Governing law and dispute resolution. A dispute in a distant court is effectively unenforceable for a small company. Arbitration is generally more enforceable across borders.
- Liability caps appropriate to the jurisdiction, since damages expectations differ.
- Data processing terms, which enterprise customers in regulated markets will require in a specific form.
- Service levels, and what the remedy actually is.
- Termination and data export — enterprise customers negotiate this hard and are right to.
- IP ownership of anything developed for the customer.
Enterprise customers overseas will send you their paper. Read it, particularly indemnities, which can exceed your insurance cover.
Export controls
Most software is unrestricted, but encryption technology, certain security tools and anything with defence or dual-use application can be subject to export controls. Check before selling into sensitive markets or to government customers.
Sanctions compliance is a separate obligation and applies regardless of the product.
Insurance
Technology errors and omissions cover, and cyber cover, should be checked for territorial limits. Policies written for New Zealand operations frequently exclude or limit certain jurisdictions.
The R&D Tax Incentive
Software development frequently qualifies where it seeks to resolve technological uncertainty. The credit is 15 percent of eligible expenditure with a $50,000 minimum, waived where expenditure is with an approved research provider.
Documentation is what determines whether a claim survives — the uncertainty, the approach, the iterations and the failures. Version control history and technical documentation serve, provided they were kept at the time.
The Office of the Privacy Commissioner publishes privacy guidance, Inland Revenue publishes GST and international tax material, and NZTE publishes market entry support. All free.
General information only, not legal or tax advice.
