New Zealand Privacy Act 2020

Why does it matter?

A New Zealand agency that suffers a data breach, buys leads from a data broker or sends customer records to a cloud provider overseas has specific duties under the Act. The Commissioner can order it to comply and the Tribunal can award damages, so the duties are better met with records ready than assembled after a complaint.

Key benefits include:

• Principles written as duties

Section 22 sets out the IPPs; IPP 1 limits collection to what is necessary for a lawful purpose connected with the agency's function, and IPP 5 requires reasonable safeguards against loss, unauthorized access, modification, disclosure and other misuse.

• A defined breach duty

Under section 112 an agency must notify the Commissioner as soon as practicable of a breach that has caused or is likely to cause serious harm, and failing to do so without reasonable excuse is an offense under section 118.

• Indirect collection is covered

IPP 3A, in force since May 1, 2026, requires reasonable steps so that the person knows what was collected, why, who receives it and their access and correction rights.

• Cross-border limits

IPP 12 allows disclosure to a foreign person only on set grounds, such as the individual's informed authorization or comparable safeguards; section 197 makes breaching a transfer prohibition notice an offense.

• Real enforcement tools

The Commissioner can issue access directions (section 92) and compliance notices (Part 6, subpart 2); offenses carry fines of up to NZD 10,000.

How does it work?

The Act works in layers. Section 22 holds the IPPs, which regulate the life cycle of personal information: purpose (IPP 1), source (IPP 2), what to tell the individual (IPP 3 and, for indirect collection, IPP 3A), manner (IPP 4), security (IPP 5), access and correction (IPPs 6 and 7), accuracy (IPP 8), retention (IPP 9), use (IPP 10), disclosure (IPP 11), overseas disclosure (IPP 12) and unique identifiers (IPP 13).

Section 8 defines the agencies covered and the exceptions, which include courts and tribunals acting judicially, news entities carrying on news activities and Members of Parliament in an official capacity. Section 27 limits the IPPs for personal or domestic affairs and section 28 removes IPPs 2, 3 and 4(b) for intelligence and security agencies.

The Commissioner can authorize otherwise prohibited handling in specific cases (section 30) and issue codes of practice that become part of the law: the Health Information Privacy Code 2020, the Credit Reporting Privacy Code 2020, the Telecommunications Information Privacy Code 2020, the Biometric Processing Privacy Code 2025 and others. Complaints go to the Commissioner first (Part 5); a person has six months from the closure of the complaint to file in the Human Rights Review Tribunal.

Key Elements

• Information privacy principles (section 22)

IPPs 1 to 13 plus IPP 3A, applied to every agency that holds personal information.

• Notifiable privacy breaches (sections 112 and 118)

Serious harm triggers notice to the Commissioner and affected people as soon as practicable; the Commissioner's guidance asks for notice within 72 hours of becoming aware.

• Access and correction (IPPs 6 and 7, section 92)

A person may ask for their information and its correction; the agency answers within 20 working days, and the Commissioner can direct access.

• Overseas disclosure (IPP 12, Part 8)

Disclosure to a foreign person must meet one of the IPP 12(1) conditions; the Commissioner can issue a transfer prohibition notice.

• Compliance notices (Part 6, subpart 2)

The Commissioner can require an agency to do or stop doing something; the Tribunal can confirm, cancel or modify the notice.

• Privacy officer (section 201)

Every agency needs at least one person who fulfills the role of privacy officer, with duties that include handling requests and liaising with the Commissioner.

What does it cover?

The Act applies to an agency, meaning any person or body, public or private, that collects or holds personal information, in any form (section 8). Section 4 extends it to overseas agencies carrying on business in New Zealand, whatever their physical presence, and to a foreign individual for information collected or held while in New Zealand. It does not apply to courts and tribunals acting judicially, news entities carrying on news activities or Members of Parliament in an official capacity (section 8), and the IPPs apply only in a limited way to personal or domestic affairs (section 27).

What are its objectives?

The purpose of the Act, in section 3, is to promote and protect individual privacy by regulating how agencies collect, hold, use and disclose personal information.

Regulate collection, storage, use and disclosure of personal information through the IPPs in section 22.

Make agencies tell people when information is collected, directly (IPP 3) or from another source (IPP 3A).

Require notice of breaches that cause or are likely to cause serious harm (section 112).

Give people rights to access and correct their information (IPPs 6 and 7), backed by access directions.

Give the Commissioner compliance notices and give the Tribunal power to hear claims.

Framework in Context

The Privacy Act 2020 replaced the Privacy Act 1993, adding IPP 12 on overseas disclosure, the notifiable breach regime, compliance notices, access directions and extraterritorial effect. The Privacy Amendment Act 2025 added IPP 3A, a change the Ministry of Justice says was designed to help New Zealand keep its EU adequacy status. The Commissioner has amended the codes of practice that replace the IPPs to reflect IPP 3A. Agencies also work with the Health Information Privacy Code 2020 for health information and the Credit Reporting Privacy Code 2020 for credit data.

Common Framework Mappings

Organizations map the Privacy Act to other privacy laws and standards so that one set of records serves several jurisdictions.

Mapped frameworks include:

Privacy Act 1988 (APPs)

LGPD

CCPA/CPRA

GDPR

ISO 27701

NIST Privacy Framework v1.0