New Zealand Computer Society CEO Paul Matthews, who is coordinating moves towards a in New Zealand, agrees with Bullwinkel's analysis.

"The issue of data sovereignty and cross-border jurisdiction, which is really what we're talking about here, is a very significant one and the clients that Mr Bullwinkel writes about are raising very valid concerns," he says in an email to Computerworld.

"Whether it's the specific Patriot Act or other legislation that empowers (for example) the US Government to compel US companies to hand over data is not relevant -- what's relevant is that they can and will.

"In many cases that simply doesn't matter -- most companies may well determine they have nothing of particular interest to the authorities in other jurisdictions that might have different privacy rules than our own, and that they're happy with that situation. However the important thing is that that is a determination for the owner of the data to make, not for their vendor to assume on their behalf.

"In many respects this gets to the heart of one of the key components of the upcoming Cloud Code of Practice - disclosure.