🇳🇿Privacy Act 2020
A principles-based privacy law with real breach and enforcement duties
New Zealand's Privacy Act 2020 is a modern, principles-based privacy law. It does not begin with a formal registration system or a GDPR-style list of lawful bases. It begins with 13 Information Privacy Principles that govern the full lifecycle of personal information: collection, notice, storage, security, access, correction, accuracy, retention, use, disclosure, overseas transfer and unique identifiers.
The Act's practical force comes from how those principles interact with individual complaints, access and correction procedures, notifiable breach obligations, compliance notices, and proceedings before the Human Rights Review Tribunal. A weak privacy programme in New Zealand is usually not exposed by one missing document. It is exposed when a collection purpose is unclear, an overseas disclosure is not assessed, a breach is not notified, or an access request is mishandled.
Who the Act covers — and why “agency” matters
The Act applies to an agency, a broad term covering New Zealand agencies, overseas agencies carrying on business in New Zealand, and certain individuals present in New Zealand in relation to information collected or held while present. A New Zealand agency includes an ordinarily resident individual, a public sector agency, a New Zealand private sector agency, and a court or tribunal except in relation to judicial functions. News entities are excluded to the extent they are carrying on news activities.
The extraterritorial reach is important. A New Zealand agency remains subject to the Act for personal information it collects or holds even where the action occurs outside New Zealand, the information is collected outside New Zealand, the information is held outside New Zealand, or the individual concerned is located outside New Zealand. An overseas agency can also be caught where it carries on business in New Zealand, even without a physical place of business or a profit-making operation.
The Act defines personal information as information about an identifiable individual. It does not require the information to be sensitive, confidential or private in the ordinary sense. If the information is about an identifiable person, the Act's structure may apply.
The 13 Information Privacy Principles — the centre of the Act
Section 22 sets out the 13 Information Privacy Principles. IPP 1 requires personal information to be collected only for a lawful purpose connected with a function or activity of the agency, and only where collection is necessary for that purpose. If identifying information is not required for the purpose, the agency may not require it.
IPP 2 requires collection from the individual concerned unless an exception applies, such as authorisation by the individual, publicly available information, law enforcement or public revenue purposes, serious threat situations, statistical or research use without identification, or cases where direct collection is not reasonably practicable.
IPP 3 requires reasonable steps to ensure that the individual is aware of the collection, purpose, intended recipients, the agency collecting and holding the information, legal authority for collection if applicable, whether supply is voluntary or mandatory, consequences of non-supply, and access and correction rights. These steps must be taken before collection or as soon as practicable after collection.
IPP 4 controls the manner of collection. Collection must be lawful, fair, and not unreasonably intrusive, with particular attention to children and young people. This makes collection design a substantive compliance question, not just a notice issue.
IPP 5 requires reasonable security safeguards against loss, unauthorised access, use, modification or disclosure, and other misuse. Where information is given to a service provider in connection with a service to the agency, the agency must do everything reasonably within its power to prevent unauthorised use or disclosure.
IPP 6 and IPP 7 create the access and correction rights. Individuals are entitled to confirmation of whether an agency holds personal information about them and access to that information. They may request correction, and if the agency refuses, they may request that a statement of correction be attached so that it is read with the disputed information.
IPP 8 requires reasonable accuracy checks before use or disclosure. IPP 9 prohibits keeping personal information longer than required for the purposes for which it may lawfully be used. IPP 10 limits use for new purposes unless an exception applies. IPP 11 limits disclosure to other agencies or persons. IPP 13 controls unique identifiers and prohibits unnecessary or risky identifier practices.
Overseas disclosure — IPP 12 is a separate transfer test
IPP 12 is one of the major changes introduced by the 2020 Act. It applies where an agency discloses personal information to a foreign person or entity in reliance on specified IPP 11 grounds. The agency must ensure one of the statutory gateways is satisfied.
The cleanest route is that the overseas recipient is required to protect the information in a way that, overall, provides comparable safeguards to the New Zealand Act. This may be because the recipient is subject to the Act, subject to comparable privacy laws, a participant in a prescribed binding scheme, located in a prescribed country, or bound by an agreement that provides comparable safeguards.
Alternatively, the individual may authorise the disclosure, but only after being expressly informed that the overseas recipient may not be required to protect the information in a way that provides comparable safeguards. That warning is not decorative. Without it, authorisation may not satisfy IPP 12.
A New Zealand company sends customer support data to an offshore SaaS provider. The business assumes this is ordinary outsourcing and relies on a broad privacy policy. Under the Privacy Act 2020, the first question is whether the disclosure fits IPP 11. The second question is IPP 12: is the overseas recipient required to provide comparable safeguards, or has the individual authorised the disclosure after being expressly warned that comparable safeguards may not apply? If the contract does not impose comparable safeguards and the individual has not been properly warned, the transfer may be non-compliant even if the original collection was lawful.
Access and correction — more than a customer service workflow
Part 4 turns IPP 6 and IPP 7 into a detailed request process. Individuals may make access requests, request urgency, and receive assistance. Agencies may transfer requests where another agency is better placed to respond. Agencies must decide whether to grant access, refuse access, or in limited cases neither confirm nor deny that information is held.
There are recognised refusal grounds. These include protection of the individual, evaluative material, security, defence and international relations, trade secrets, unreasonable prejudice to commercial position, legal professional privilege, maintenance of the law, and unwarranted disclosure of another person's affairs. Refusal should not be treated as a convenience option; it must fit a statutory ground.
Correction requests have their own structure. An agency must decide whether to correct the information and whether to attach a statement of correction if it does not make the requested correction. Where information is corrected or a statement is attached, the agency must, so far as reasonably practicable, inform every other person to whom the agency has disclosed the information.
Notifiable privacy breaches — serious harm is the trigger
Part 6 creates a mandatory breach notification regime. A notifiable privacy breach is a privacy breach that has caused, or is likely to cause, serious harm to an affected individual. When assessing serious harm, an agency must consider matters including steps taken to reduce risk, whether the information is sensitive, the nature of the possible harm, who has obtained or may obtain the information, whether the information was protected by security measures, and any other relevant matters.
An agency must notify the Privacy Commissioner as soon as practicable after becoming aware that a notifiable privacy breach has occurred. It must also notify affected individuals as soon as practicable, unless an exception applies, notification may be delayed, or public notice is required because individual notification is not reasonably practicable.
Failure to notify the Commissioner without reasonable excuse is an offence punishable by a fine not exceeding NZD 10,000. It is not a defence that the agency took steps to address the breach. It may be a defence that the agency did not consider the breach notifiable, but only if that view was reasonable in the circumstances.
Compliance notices and enforcement
The Privacy Commissioner may issue a compliance notice where the Commissioner considers that a breach of the Act, an action treated as a breach of an IPP, or a breach of a code of practice may have occurred. The notice may require the agency to remedy the breach, take specified steps, comply by a stated date, and report to the Commissioner.
Before issuing a compliance notice, the Commissioner must consider relevant factors such as whether another means is available to deal with the breach, the seriousness of the breach, likelihood of repetition, number of affected people, the agency's cooperation, and likely compliance costs. The agency must be given a reasonable opportunity to comment before the notice is issued.
Compliance notices can be appealed to the Human Rights Review Tribunal. The Tribunal may confirm, cancel or modify the notice or decision. If the agency does not comply, the Commissioner may bring enforcement proceedings and the Tribunal may order the agency to comply or perform specified acts.
Complaints, interference with privacy and remedies
The Act allows complaints to be made to the Privacy Commissioner. The Commissioner may investigate, refer the complaint, explore settlement, summon persons, require information and documents, and refer matters to the Director of Human Rights Proceedings.
Proceedings may be brought before the Human Rights Review Tribunal by the Director or, in certain circumstances, by an aggrieved individual. Remedies for interference with privacy may include declarations, orders restraining conduct, orders requiring action, damages, and other relief. Damages may cover pecuniary loss, loss of benefit, humiliation, loss of dignity and injury to feelings.
Privacy officers, codes and information sharing
Section 201 requires every agency to have one or more privacy officers. The privacy officer's role includes encouraging compliance with the IPPs, dealing with requests made under the Act, working with the Commissioner in relation to investigations, and ensuring the agency complies with the Act.
The Commissioner may issue codes of practice that modify, apply or prescribe how the IPPs operate for specified information, agencies, activities, industries, professions or callings. Codes cannot limit or restrict the access and correction entitlements under IPP 6 and IPP 7.
The Act also contains detailed regimes for approved information sharing agreements, access to identity information, law enforcement information, and authorised information matching programmes. These regimes matter especially for public sector and law enforcement contexts because they create structured rules for sharing and matching information that might otherwise breach the general IPPs.
Onward transfer prohibition
Part 8 gives the Commissioner a specific power to prohibit onward transfer of personal information received in New Zealand from overseas. This is separate from IPP 12. It allows the Commissioner to act where information has come into New Zealand from overseas and is at risk of being transferred onward in a way that undermines basic privacy protections.
Section 3 — Purpose: promotes and protects individual privacy while recognising other rights and interests and giving effect to international privacy standards.
Section 4 — Application: covers New Zealand agencies, overseas agencies carrying on business in New Zealand, and certain individuals present in New Zealand.
Sections 7–9 — Definitions: personal information, agency, New Zealand agency and overseas agency.
Section 17 — Privacy Commissioner functions: education, advice, monitoring, research, audits, reports and general privacy oversight.
Section 22 — Information Privacy Principles: 13 principles governing collection, notice, security, access, correction, use, disclosure, overseas disclosure and unique identifiers.
Sections 39–67 — Access and correction procedures, refusal grounds, extensions, conditions and charges.
Sections 70–111 — Complaints, investigations and proceedings before the Human Rights Review Tribunal.
Sections 112–122 — Notifiable privacy breach regime, including serious harm assessment and notification to the Commissioner and affected individuals.
Sections 123–135 — Compliance notices, agency responses, enforcement and appeals.
Section 201 — Privacy officers: every agency must have one or more privacy officers.
The New Zealand Privacy Act 2020 is practical and systems-driven. Your organisation must be able to justify collection, collect fairly, notify clearly, protect information, respond to access and correction requests, check accuracy before use or disclosure, limit retention, control reuse and disclosure, assess overseas transfers under IPP 12, notify serious breaches, and maintain a privacy officer function. The law does not require a perfect privacy programme. It requires a working one that can withstand a complaint, breach, transfer review or compliance notice.