🇳🇿New Zealand

New Zealand's privacy framework is built around principles, not registration

New Zealand's privacy regime is anchored by the Privacy Act 2020. It replaced the Privacy Act 1993 and came into force on 1 December 2020. The Act is designed to promote and protect individual privacy while recognising that other rights and interests may also need to be taken into account. It gives effect to internationally recognised privacy standards, including the OECD Guidelines and the International Covenant on Civil and Political Rights.

The framework is not built around a general database registration obligation. It is built around 13 Information Privacy Principles, enforceable access and correction mechanisms, notifiable privacy breach duties, compliance notices, and specific rules for overseas disclosures. The central actor is not called a controller or processor. The Act uses the broader term agency.

The three pillars to understand first

The Information Privacy Principles answer the core operational question: how may an agency collect, store, use, disclose, retain and transfer personal information? The principles cover collection purpose, collection source, notice, fair collection, security, access, correction, accuracy before use or disclosure, retention, use limits, disclosure limits, overseas disclosure and unique identifiers.

The Privacy Commissioner is the independent regulator. The Commissioner promotes understanding of the Act, investigates complaints, examines proposed legislation and policy, monitors technology developments, issues codes of practice, handles notifiable privacy breaches, and may issue compliance notices where an agency appears to have breached the Act or an applicable code.

The individual rights framework gives people practical access and correction rights. Individuals may request confirmation that an agency holds personal information about them and access to that information. They may also request correction, or require a statement of correction to be attached where the agency does not make the correction sought.

How the Act applies

The Act applies to New Zealand agencies in relation to actions taken in respect of personal information, even if the agency is not present in New Zealand at the time and even if the information is collected or held overseas. It also applies to overseas agencies carrying on business in New Zealand in relation to personal information they collect or hold. An overseas agency may be treated as carrying on business in New Zealand even without a place of business in New Zealand, without receiving monetary payment, and without intending to make a profit.

The Act defines personal information simply: information about an identifiable individual. It applies across public and private sector agencies, subject to exclusions and special rules for entities such as courts acting judicially, Parliament-related bodies, inquiries, Ombudsmen, and news entities carrying on news activities.

What organisations should prioritise

Start with the 13 Information Privacy Principles. Check whether each collection has a lawful and necessary purpose, whether information is collected from the individual unless an exception applies, whether the collection notice is adequate, whether collection methods are fair, and whether security safeguards are reasonable in the circumstances.

Then test use and disclosure. Personal information obtained for one purpose cannot simply be reused for another. Disclosure to another agency or person must fit within IPP 11. Disclosure to a foreign person or entity must also satisfy IPP 12, which requires comparable safeguards unless the individual has authorised the disclosure after being expressly informed that the overseas recipient may not provide comparable protection.

Finally, build breach and rights workflows. A notifiable privacy breach must be reported to the Commissioner as soon as practicable, and affected individuals must also be notified unless an exception or delay applies. Access and correction requests require structured handling, including transfer, refusal grounds, extensions and correction statements.