New Zealand Data Privacy Laws: Privacy Act 2020 Complete Guide (2026)

New Zealand's Privacy Act 2020 (No 31) governs how agencies collect, store, use, and disclose personal information through 13 Information Privacy Principles. The Privacy Amendment Act 2025 added IPP 3A, an indirect-collection notification rule in force from May 1, 2026, closing a gap that existed for third-party data collection.

Information last verified on 2026-09-09. This article has not been reviewed by a licensed New Zealand lawyer.

Jurisdiction scope: This article addresses New Zealand's data protection framework under the Privacy Act 2020 (No 31), the Privacy Amendment Act 2025, the Biometric Processing Privacy Code 2025, and the regulatory practice of the Office of the Privacy Commissioner (Te Mana Matapono Matatapu). It does not address the Crimes Act 1961 recording offences or the Harmful Digital Communications Act 2015. For recording law specifically, see New Zealand Recording Laws.

Quick Answer: What Does New Zealand's Privacy Law Require?

New Zealand's primary data protection statute is the Privacy Act 2020, which came into force on December 1, 2020. The Act imposes 13 Information Privacy Principles (IPPs) on every "agency" that handles personal information about New Zealand individuals, whether that agency is located in New Zealand or overseas. Core obligations include: collecting information only for a lawful purpose connected to the agency's functions; notifying individuals at the point of collection; keeping information secure; allowing individuals to access and correct their data; limiting secondary use and disclosure; restricting cross-border transfers to countries with comparable protections; and reporting serious privacy breaches to both the Privacy Commissioner and affected individuals. The Privacy Amendment Act 2025 added a fourteenth obligation in substance by inserting IPP 3A, which requires notification when information is collected indirectly (from a third-party source rather than from the individual). IPP 3A came into force on May 1, 2026. The Office of the Privacy Commissioner supervises compliance, issues compliance notices, and refers unresolved matters to the Human Rights Review Tribunal, which can award damages up to NZD 350,000.

The Privacy Act 2020 and the Office of the Privacy Commissioner

The Privacy Act 2020 is New Zealand's comprehensive data protection statute. Parliament enacted it to replace the Privacy Act 1993, which had governed the country's privacy framework for nearly three decades but was considered inadequate for the digital economy. The new Act broadened the definition of "carrying on business" in New Zealand to capture overseas agencies that process New Zealanders' data without a physical presence in the country, introduced mandatory breach notification for the first time, strengthened compliance powers, and modernised the cross-border transfer provisions.

The Office of the Privacy Commissioner (OPC), known in te reo Maori as Te Mana Matapono Matatapu, is the independent regulator that administers the Act. The current Privacy Commissioner is Michael Webster CVO, who has served since July 5, 2022, succeeding John Edwards (February 2014 to December 2021). The OPC investigates complaints, monitors compliance, issues guidance and codes of practice, represents New Zealand in international privacy forums, and maintains the NotifyUs portal for breach notifications.

The Act applies to every "agency" that handles personal information. The definition of agency under section 7 is deliberately broad: any person or organisation in the public or private sector, including government departments, companies, charities, schools, sports clubs, and sole traders. Section 4 applies the Act to an overseas agency in relation to any action it takes in the course of carrying on business in New Zealand, even without a local office, on the basis that it offers services to or collects data about New Zealand residents.

Personal information under section 7 means information about an identifiable individual. The definition covers names, addresses, email accounts, phone numbers, financial records, health data, employment history, photographs, IP addresses, and any other data that can identify a living person. Information about deceased persons falls outside the scope of the Act.

The 13 Information Privacy Principles

The 13 Information Privacy Principles in Part 3 of the Act are the operational core of New Zealand's data protection regime. Each principle governs a distinct phase of the information lifecycle, from collection through to correction. The principles are still numbered 1 to 13, with IPP 3A inserted after IPP 3 from May 1, 2026, so there are fourteen enforceable principles in total. Every agency subject to the Act must comply with all of them. Breach of a principle is an "interference with privacy" under section 69, which the Commissioner can investigate and the Tribunal can remedy.

IPP 1: Purpose of Collection

IPP 1 requires that personal information be collected only for a lawful purpose connected with a function or activity of the agency, and only when collection is necessary for that purpose. An agency cannot collect data "just in case" or for an undefined future use. The necessity requirement means the agency must be able to articulate why each category of information it collects is required to carry out the specific activity.

IPP 2: Source of Information

IPP 2 provides that personal information should be collected directly from the individual concerned wherever possible. Collecting from a third-party source is permissible where the individual authorises it, where direct collection would prejudice the purpose of collection, where the information is publicly available, or where other statutory exceptions apply. IPP 2 sets the default; IPP 3A now addresses the notification obligation when collection is indirect.

IPP 3: Collection From the Individual (Direct Collection)

IPP 3 requires agencies to take reasonable steps, at or before the time of collection, to ensure the individual is aware of:

• the fact of collection and the purpose for which the information is being collected;
• the intended recipients of the information;
• the name and address of the collecting agency;
• whether collection is authorised or required by law, and if so, the particular law;
• the consequences (if any) of not providing the information; and
• the individual's rights of access and correction under IPPs 6 and 7.

This notification obligation under IPP 3 applies when the agency collects information directly from the individual, for example through a web form, a phone call, or an in-person interview.

IPP 3A: Indirect-Collection Notification (In Force May 1, 2026)

The Privacy Amendment Act 2025 (No 53), which received Royal Assent on September 23, 2025, inserted IPP 3A into the Privacy Act 2020. IPP 3A came into force on May 1, 2026 and does not apply retrospectively to personal information collected before that date.

IPP 3A is an indirect-collection notification obligation. When an agency collects personal information from a source other than the individual concerned, for example from a third-party data broker, a credit bureau, a public register, a social media platform, or another organisation, the agency must take reasonable steps to ensure the individual is aware of the same matters specified in IPP 3. The Office of the Privacy Commissioner's IPP 3A guidance describes this as closing the gap between what New Zealand required on direct collection and what comparable regimes in Australia and the EU already required for indirect collection.

What IPP 3A is NOT: IPP 3A does not regulate automated decision-making. It does not impose specific rules on biometric processing. Those topics are addressed separately: automated-decision controls are the subject of the Commissioner's 2025 reform proposals, and biometrics are governed by the Biometric Processing Privacy Code 2025 (see below). Describing IPP 3A as an automated-decision or biometric rule is incorrect.

Exemptions to the IPP 3A notification obligation sit in IPP 3A(3) to (7). The list below is not exhaustive. The broadest exception, and the one most agencies will actually rely on, is the first:

• the agency believes on reasonable grounds that non-compliance would not prejudice the interests of the individual concerned (IPP 3A(4)(a));
• the individual has already been made aware of all the matters listed in IPP 3A(1) (IPP 3A(3));
• the information is publicly available (for example, from a public register, newspaper, or public website);
• non-compliance is necessary to avoid prejudice to the maintenance of the law, for the enforcement of a law imposing a pecuniary penalty, for the protection of public revenue, or for the conduct of court or tribunal proceedings;
• compliance would prejudice the purposes of the collection;
• compliance would cause a serious threat to public health or safety, or to the health or safety of another individual;
• the information will not be used in a form that identifies the individual, or will be used for statistical or research purposes and not published in identifying form;
• compliance is not reasonably practicable in the circumstances;
• the agency is deciding whether the information is of enduring value and should be archived for public reference, and compliance would seriously impair that purpose (IPP 3A(5));
• compliance would disclose a trade secret or unreasonably prejudice the commercial position of the supplier of the information or of the individual (IPP 3A(7)).

IPP 3A(6) adds further exceptions where compliance would prejudice New Zealand's security, defence, or international relations.

The Ministry of Justice led the policy process behind IPP 3A, which was driven in part by the need to maintain New Zealand's EU adequacy status and align domestic law with international notification standards.

IPP 4: Manner of Collection

IPP 4 prohibits agencies from collecting personal information by unlawful means or by means that are unfair or unreasonably intrusive having regard to the circumstances.

IPPs 5 to 9: Storage, Security, Access, Accuracy, and Retention

IPP 5 (Storage and Security) requires agencies to protect personal information against loss, unauthorised access, use, modification, or disclosure by means that are reasonable in the circumstances, having regard to the sensitivity of the information and the harm that could result from a breach.

IPP 6 (Access) gives individuals the right to access their own personal information held by an agency. The agency must respond as soon as is reasonably practicable, and in any case within 20 working days of receiving a request. The agency may refuse access on limited grounds, such as protecting national security, trade secrets, or the privacy of another individual.

IPP 7 (Correction) gives individuals the right to request correction of inaccurate, incomplete, or misleading personal information. If the agency refuses to correct the information, it must attach a statement of the desired correction to the record. The 20-working-day response period also applies to correction requests.

IPP 8 (Accuracy) requires agencies to take reasonable steps to ensure that personal information is accurate, up to date, complete, relevant, and not misleading before using it. This obligation is ongoing; it is not satisfied by a one-time accuracy check at the point of collection.

IPP 9 (Retention) states that agencies must not keep personal information for longer than is necessary for the purposes for which it may lawfully be used. Retention schedules should be documented and enforced.

IPPs 10 and 11: Secondary Use and Disclosure

IPP 10 (Limits on Use) restricts how agencies use personal information. Information collected for one purpose generally may not be used for a materially different purpose unless the individual authorises the secondary use, the information is publicly available, the use is directly related to the original purpose, or one of the statutory exceptions applies (such as preventing a serious threat to life or safety).

IPP 11 (Limits on Disclosure) restricts disclosure of personal information to third parties. Permitted grounds for disclosure include: the disclosure is one of the purposes of collection; the individual authorises it; the information is publicly available; disclosure is necessary to prevent or lessen a serious threat to public health or safety; or disclosure is necessary to facilitate the sale or other disposition of a business where reasonable steps are taken to ensure the recipient treats the information consistently with the Act.

IPP 12: Cross-Border Disclosure

IPP 12 is New Zealand's cross-border transfer restriction. It bites where an agency discloses personal information to a foreign person or entity in reliance on IPP 11(1)(a), (c), (e), (f), (h), or (i), and IPP 12(2) switches it off for IPP 11(1)(e) or (f) disclosures where complying is not reasonably practicable. Where it applies, the agency must not make the disclosure unless at least one of the following conditions is met:

1. The individual authorises the disclosure after being expressly informed that the overseas recipient may not be required to protect the information in a way comparable to the Act.
2. The agency believes on reasonable grounds that the recipient is subject to the Privacy Act (for example, because it carries on business in New Zealand).
3. The agency believes on reasonable grounds that the recipient is subject to privacy laws of another country that provide comparable safeguards to the Act.
4. The agency believes on reasonable grounds that the recipient is a participant in a prescribed binding scheme, meaning a scheme specified in regulations made under section 213.
5. The agency believes on reasonable grounds that the recipient is subject to the privacy laws of a prescribed country, meaning a country specified in regulations made under section 214.
6. The agency otherwise believes on reasonable grounds that the recipient is required to protect the information in a way that, overall, provides comparable safeguards, for example under a contract between the two.

The OPC provides an IPP 12 Decision Tree and model contract clauses to assist agencies with cross-border transfer compliance. Agencies that store data with overseas cloud providers generally remain the responsible agency under section 11 of the Act and must ensure their cloud contracts include appropriate privacy protections.

New Zealand holds EU adequacy status under Article 45 of the GDPR. The European Commission conducted a review of 11 adequacy decisions and confirmed on January 15, 2024 that New Zealand continues to provide an adequate level of data protection. This means personal data may flow freely from the EEA to New Zealand without the need for standard contractual clauses, binding corporate rules, or other transfer mechanisms.

IPP 13: Unique Identifiers

IPP 13 restricts how agencies assign and use unique identifiers such as customer numbers, membership numbers, or other codes. An agency must not assign a unique identifier to an individual unless it is necessary for the agency's functions. Agencies must not require individuals to disclose a unique identifier assigned by another agency unless there is a lawful basis for doing so. This principle is intended to prevent the construction of comprehensive profiles by cross-referencing identifiers across organisations.

The Biometric Processing Privacy Code 2025

The Biometric Processing Privacy Code 2025 (BPPC) is a code of practice made by the Privacy Commissioner under section 32 of the Privacy Act 2020, after the consultation section 33 requires. It is a separate instrument from the IPPs; it does not amend the Act but modifies how the IPPs apply to biometric processing activities. The OPC made the BPPC on July 21, 2025, and it came into force on November 3, 2025. Agencies already using biometric systems on that date had a nine-month transition, and that transition ended on August 3, 2026. The Code now applies to every agency doing biometric processing, legacy deployments included, and a legacy deployment that was never brought into line is non-compliant.

Amendment No 1 to the Code, made on March 25, 2026 under section 37 of the Act, inserted Rule 3A to mirror the new IPP 3A notification obligation for biometric information collected other than from the individual concerned. The consolidated Code, version as at May 1, 2026, therefore contains 14 rules: 1, 2, 3, 3A, and 4 to 13.

Scope: The BPPC applies to all agencies that collect, store, use, handle, process, or disclose biometric information through biometric processing. Biometric information means information relating to an individual's physical or behavioural features, including facial geometry, fingerprints, iris patterns, voice patterns, and keystroke or gait patterns. Biometric processing means the use of technologies such as facial recognition, fingerprint scanning, or voice identification to collect and process that information to identify individuals or learn more about them. The BPPC does not apply to health information processed by a health agency under the Health Information Privacy Code.

Core obligations under the BPPC include:

1. The Rule 1 collection gate: Biometric information must not be collected unless the biometric processing is "for a lawful purpose connected with a function or an activity of the agency", is "necessary for that particular purpose", including that it is "effective in achieving the agency's lawful purpose" and that the purpose "cannot reasonably be achieved as effectively by an alternative means that has less privacy risk", the agency "has adopted and implemented such privacy safeguards as are reasonable in the circumstances", and the agency "believes, on reasonable grounds, that the biometric processing is proportionate to the likely impacts on individuals" (Rule 1(1)). Where an agency cannot satisfy the necessity limb before collecting, Rule 1(2) lets it establish a trial and defer that limb until the trial period ends.
2. The proportionality factors: In forming that proportionality belief, Rule 1(3) requires the agency to take into account the scope, extent and degree of privacy risk, whether the benefit of achieving its lawful purpose outweighs that risk, and "the cultural impacts and effects of biometric processing on Maori". The Code does not require a privacy impact assessment, and the phrase appears nowhere in it. The OPC recommends a documented PIA as good practice, and it is the practical way to evidence the Rule 1 judgment, but completing one does not by itself discharge the Code.
3. Transparency and notice: Agencies must inform individuals before or at the time of collection about the collection, its purpose, intended recipients, legal authority (if any), and the individual's rights. The Code requires clear and conspicuous signage and communications.
4. Safeguards: Agencies must adopt technical and organisational safeguards proportionate to the sensitivity and privacy risks of the biometric data.
5. Accuracy and bias assessment: Agencies must take steps to ensure the biometric system performs accurately across different demographic groups. The Commissioner's June 2025 inquiry into Foodstuffs North Island's supermarket facial recognition trial found that accuracy concerns for Maori, Pacific peoples, and other ethnic groups must be addressed before deployment.

The BPPC's necessity and proportionality test is more demanding than the general security obligations under IPP 5. Organisations deploying facial recognition, fingerprint access systems, or voice authentication must be able to show they made the Rule 1 judgment, on reasonable grounds, before going live.

Mandatory Breach Notification

Part 6 of the Privacy Act 2020 introduced mandatory privacy breach notification to New Zealand law for the first time. Under the 1993 Act, reporting was voluntary. The 2020 Act made it compulsory.

What counts as a notifiable breach: A privacy breach is a "notifiable privacy breach", as defined in section 112, where it has caused, or is likely to cause, serious harm to one or more affected individuals. Section 113 sets out the factors an agency must weigh in assessing that likelihood: agencies must consider the nature and sensitivity of the personal information; what has happened to the information (theft, accidental disclosure, corruption, etc.); the likely recipients; whether security measures such as encryption were in place; and the types of harm that could follow. Serious harm includes identity theft, financial loss, physical danger, psychological harm, employment-related harm, and threats to safety. The Commissioner's guidance places heightened weight on breaches involving health records, financial data, information about children, or data concerning family violence victims.

Notification obligations: When a breach meets the serious harm threshold, the agency must:

1. Notify the Privacy Commissioner under section 114, as soon as practicable after becoming aware of the breach. The OPC's operational expectation is notification within 72 hours. Notifications must be submitted through the NotifyUs portal and must describe the nature of the breach, the categories of personal information affected, the likely consequences, and the steps the agency is taking. Section 117 permits incremental notification where the full picture is not yet available.

2. Notify affected individuals under section 115, as soon as practicable, or give public notice where notifying individuals is not reasonably practicable. The notice must describe the breach, the information involved, the steps the individual can take to protect themselves, and the agency's response measures. Section 116 provides limited exceptions, such as where notification would endanger the safety of any person or prejudice a law enforcement investigation.

Penalty for failure to notify: Section 118 of the Act makes it a criminal offence for an agency to fail to notify the Commissioner of a notifiable breach without reasonable excuse. The penalty is a fine of up to NZD 10,000.

The OPC received and processed 1,598 privacy complaints in 2024/25, up 21 percent on the previous year, and received 1,093 privacy breach notifications, up 27 percent (Annual Report of the Privacy Commissioner 2025). Many involved unauthorised disclosures by retailers, health data handling failures, and decisions affecting lending.

Individual Rights Under the Privacy Act 2020

The Act gives individuals several enforceable rights in relation to their personal information held by agencies:

Right of access (IPP 6): Any individual may request access to personal information an agency holds about them. The agency must respond within 20 working days. Charges may only be imposed for the reasonable cost of giving access and must not be so large as to be a deterrent.

Right of correction (IPP 7): Any individual may request that inaccurate, incomplete, or misleading information be corrected. The agency must respond within 20 working days. If it declines, it must attach a note of the requested correction to the record.

Right to complain: Individuals who believe an agency has interfered with their privacy may complain to the Office of the Privacy Commissioner free of charge. Before lodging a complaint with the OPC, the individual should first raise the matter directly with the agency. The Commissioner investigates and attempts mediated settlement. If settlement fails, the individual may take the matter to the Human Rights Review Tribunal, either through the Director of Human Rights Proceedings or directly (within six months of the Commissioner's closure notice under section 98).

The Act does not provide a GDPR-style "right to be forgotten" or right to erasure. Commissioner Webster has publicly called for a right to erasure to be introduced in a future reform, but as of September 2026 the Act does not contain one.

Enforcement Powers and Penalties

The Privacy Commissioner's enforcement toolkit under the Privacy Act 2020 includes the following powers:

Compliance notices: Under sections 123 and 124 of the Act, the Commissioner may issue a compliance notice requiring an agency to take, or stop, specified action where the Commissioner believes the agency is breaching, or is likely to breach, the Act. Section 127 requires the agency to take steps to comply. The agency may appeal the notice to the Human Rights Review Tribunal within 15 working days (section 131). If it neither complies nor appeals, the Commissioner may bring enforcement proceedings in the Tribunal (section 130), and the Tribunal may order the agency to comply by a specified date (section 133(1)(a)). It is failing to comply with that Tribunal order, without reasonable excuse, that is the offence (section 133(3)). Failing to comply with the compliance notice itself is not, on its own, a criminal offence.

Name and shame: The Commissioner has a publicly stated policy of naming agencies found to have breached the Act in cases where it is in the public interest to do so, for example where an agency has shown an unwillingness to comply or where public awareness could reduce harm.

Referral to the Director of Human Rights Proceedings: Where mediation fails, the Commissioner may refer the matter to the Director of Human Rights Proceedings, who can bring proceedings before the Human Rights Review Tribunal on behalf of the complainant.

Human Rights Review Tribunal: The Tribunal is an independent judicial body that can award:

• A declaration that the agency has interfered with the individual's privacy.
• An order restraining the agency from continuing the interference.
• Compensatory damages up to NZD 350,000, including damages for humiliation, loss of dignity, and injury to feelings.
• An order requiring corrective action or restitution.
• Costs.

The absence of large financial penalties: Unlike the GDPR, which provides for fines of up to 4 percent of global annual turnover, the Privacy Act 2020 does not authorise large fines. The NZD 350,000 Tribunal damages cap and the NZD 10,000 criminal offence fines are the primary financial consequences. In a statement on November 13, 2025 the Commissioner called for "establishing a new and significantly stronger penalty regime", alongside a right to erasure, privacy management programmes on the OECD model that agencies can demonstrate, and stronger protections for automated decision making. He named no figure and drew no comparison to a particular overseas cap. The Government has not announced a further Privacy Act amendment.

Recent Developments (2024 to 2026)

January 2024: EU adequacy reaffirmed: The European Commission completed a review of 11 adequacy decisions and confirmed on January 15, 2024 that New Zealand continues to provide an adequate level of protection. The Commission noted that the Privacy Act 2020, the enhanced IPP 12 cross-border transfer rules, and the broadened powers of the OPC all contributed to New Zealand's continued alignment with the EU framework.

September 2025: Privacy Amendment Act 2025 enacted: Parliament passed the Privacy Amendment Act 2025 on September 23, 2025 (Royal Assent the same day). The Act inserted IPP 3A, the indirect-collection notification obligation, into the Privacy Act 2020. IPP 3A came into force on May 1, 2026 and applies prospectively to personal information collected on or after that date.

November 2025: Biometric Processing Privacy Code 2025 in force: The BPPC, made by the Privacy Commissioner on July 21, 2025, came into force on November 3, 2025. Agencies already operating biometric systems had until August 3, 2026 to comply, and that transition has now ended. The Code introduces the Rule 1 necessity and proportionality gate, the accuracy and bias expectations, and the transparency requirements described in the preceding section.

June 2025: Foodstuffs facial recognition inquiry: The Privacy Commissioner released findings on June 4, 2025 into Foodstuffs North Island's (FSNI) trial of facial recognition technology across 25 supermarkets in the North Island between February and September 2024. The OPC's inquiry found that the trial complied with the Privacy Act, given the safeguards FSNI deployed, but raised concerns about bias risk for Maori and Pacific peoples, the adequacy of customer transparency, and the accuracy of overseas-trained systems applied to New Zealand's population. The Commissioner recommended independent evaluation of any future deployment.

November 2025: Commissioner calls for modernisation: On November 13, 2025, alongside the 2024/25 Annual Report, Commissioner Webster recommended four amendments to the Act: a right to erasure; a new and significantly stronger penalty regime; a requirement that agencies be able to demonstrate how they meet their privacy obligations, along the lines of the privacy management programmes the OECD recommends; and stronger protections for automated decision making. The report recorded a 21 percent rise in complaints and a 27 percent rise in privacy breach notifications; in the accompanying statement the Commissioner also noted that notifications of serious privacy breaches rose 43 percent.

January to March 2026: Codes of practice amended for IPP 3A: By Gazette notice 2026-au42, dated January 12, 2026, the Privacy Commissioner consulted under section 33 on amendments to the Biometric Processing Privacy Code 2025, the Credit Reporting Privacy Code 2020, the Health Information Privacy Code 2020, and the Telecommunications Information Privacy Code 2020, each creating a new rule 3A, plus a technical fix to the Civil Defence National Emergencies (Information Sharing) Code 2020. Submissions closed at 4pm on February 16, 2026, and the Commissioner made the amendments in March 2026.

May 2026: IPP 3A and rule 3A commence: IPP 3A took effect on May 1, 2026, and Amendment No 1 to the Biometric Processing Privacy Code 2025 brought Rule 3A into force on the same date for biometric processing that started after November 3, 2025. On May 27, 2026 the OPC published the executive summary of its inquiry into the cyber security breach affecting the Manage My Health Limited patient portal, which the company notified to the OPC on January 1, 2026.

August 2026: Biometrics transition ends: On August 3, 2026 the nine-month transition for biometric processing that had commenced on or before November 3, 2025 expired, bringing the Code, including Rule 3A, into force for those legacy deployments. The Commissioner also published a statement on the proposed under-16s social media ban on August 27, 2026 and set out his expectations for smart glasses on August 28, 2026.

Business Compliance

Organisations operating in New Zealand, or processing the personal information of New Zealand residents from overseas, should structure their privacy compliance programmes around the following core elements:

Map your data flows. Document every category of personal information you collect, the source of that collection (direct from individual or indirect from third parties), the purpose, the intended recipients, and any cross-border transfers. This foundation is needed to assess compliance with IPPs 1 to 4, including the new IPP 3A indirect-collection notification obligation.

Implement IPP 3A notification procedures. For personal information collected on or after May 1, 2026 from a source other than the individual, establish a process to notify the individual of the matters listed in IPP 3. IPP 3A(2) requires those steps to be taken as soon as is reasonably practicable after the information has been collected, unless taken sooner. The OPC's IPP 3A guidance describes acceptable notification methods, including written notices, email, and web portal notifications, and puts the burden on the agency: if you decide it is not practicable to notify shortly after collection, it is your agency's responsibility to justify that, and documenting the rationale will matter. Review third-party data-sharing agreements to determine whether existing supplier notifications satisfy the obligation.

Assess biometric systems against the BPPC. If your organisation uses facial recognition, fingerprint scanning, voice authentication, or any other biometric processing technology, note that the transition for legacy deployments ended on August 3, 2026, so the Code applies to you now and any deployment not brought into line is non-compliant. Record the Rule 1 judgment: the lawful purpose, necessity and effectiveness, the absence of an alternative that would be reasonably as effective at less privacy risk, the safeguards adopted, and proportionality including cultural impacts and effects on Maori. The Code does not require a privacy impact assessment, but the OPC recommends one and it is the practical way to document that judgment, alongside bias mitigation for Maori and Pacific communities.

Establish breach response procedures. Designate a privacy officer responsible for identifying and assessing privacy breaches. Ensure the organisation can triage a suspected breach, assess the serious harm threshold, notify the OPC via NotifyUs within 72 hours where the threshold is met, and notify affected individuals promptly.

Review cross-border transfer arrangements. For data transfers to countries outside New Zealand, assess whether IPP 12 is satisfied. Transfers to countries without comparable protections require either individual consent (with express disclosure of the risks) or contractual protections. A New Zealand agency disclosing personal information to an EEA recipient can generally rely on IPP 12(1)(c), because the GDPR provides comparable safeguards. New Zealand's EU adequacy status runs the other way: it lets EEA businesses send personal data to New Zealand without standard contractual clauses or other transfer tools.

Respond to access and correction requests. Ensure the organisation has a process for receiving and responding to individual access and correction requests within the 20-working-day statutory timeframe.

Watch out: The IPP 3A obligation applies to personal information collected from third-party sources on or after May 1, 2026. Agencies that purchase customer lists, receive data from analytics providers, use credit bureau data, or aggregate information from public registers now have an active notification obligation to the individuals whose data they acquire. Overlooking this obligation is the most likely new compliance gap for data brokers, credit agencies, and marketing-focused businesses in 2026.

Frequently Asked Questions

Does the Privacy Act 2020 apply to overseas companies?

Yes. Section 4 of the Privacy Act 2020 applies the Act to an overseas agency in relation to any action it takes in the course of carrying on business in New Zealand, even without a physical office in the country. Any organisation that provides services to New Zealand residents or systematically collects their personal information is subject to the same obligations as a New Zealand-based agency. Complaints against overseas agencies can be brought to the Privacy Commissioner.

What is the difference between IPP 3 and IPP 3A?

IPP 3 applies when an agency collects personal information directly from the individual, for example through a form, interview, or phone call. IPP 3A, which came into force on May 1, 2026, applies when an agency collects personal information from a third-party source rather than from the individual. Both principles impose the same notification obligation: the individual must be made aware of the collecting agency, the purpose, intended recipients, lawful basis (if any), and their access and correction rights. IPP 3A closes the notification gap that previously existed for indirect collection.

Is IPP 3A about automated decision-making or biometrics?

No. IPP 3A is solely about notification when personal information is collected indirectly. It has nothing to do with automated decision-making or biometric processing. Automated-decision controls are the subject of a separate reform proposal by Commissioner Webster. Biometric processing is governed by the Biometric Processing Privacy Code 2025, which is a distinct instrument that came into force on November 3, 2025.

What does the Biometric Processing Privacy Code 2025 require?

The BPPC's Rule 1 gate is the core requirement: biometric information must not be collected unless the processing is for a lawful purpose connected with the agency's functions, is necessary for that purpose (effective, with no alternative that would be reasonably as effective at less privacy risk), the agency has adopted reasonable privacy safeguards, and the agency believes on reasonable grounds that the processing is proportionate to the likely impacts on individuals, taking into account cultural impacts and effects on Maori. The Code also requires transparency notices, safeguards, and attention to accuracy across demographic groups. It does not require a privacy impact assessment, although the OPC recommends one as good practice. Agencies already using biometric systems before November 3, 2025 had until August 3, 2026 to comply, and that transition has now ended.

What counts as a notifiable privacy breach?

A privacy breach is a notifiable privacy breach, as defined in section 112, if it has caused, or is likely to cause, serious harm to an affected individual, and section 113 lists the factors used to assess that likelihood. Serious harm includes identity theft, financial loss, physical safety risks, psychological harm, and employment consequences. The Commissioner's guidance places heightened concern on breaches involving health data, financial records, children's information, or data related to family violence. The practical test is whether a reasonable person in the same circumstances as the affected individual would consider the breach likely to cause them serious harm.

What is the time limit for notifying the Privacy Commissioner of a breach?

The Act requires notification "as soon as practicable" after the agency becomes aware of the breach. The OPC's operational expectation is notification within 72 hours. Section 117 allows incremental notification if the full picture is not yet available.

What financial penalties can be imposed under the Privacy Act 2020?

There are no GDPR-style turnover-based fines under the current Act. The Human Rights Review Tribunal can award compensatory damages up to NZD 350,000 in civil proceedings. Offences under the Act are punishable by fine only, and the maximum fine a court can impose is NZD 10,000. Those offences include failing to notify the Commissioner of a notifiable breach (section 118) and failing to comply, without reasonable excuse, with a Tribunal order made in relation to a compliance notice (section 133(3)). On November 13, 2025 the Privacy Commissioner recommended a new and significantly stronger penalty regime. The Government has not announced a further Privacy Act amendment.

Does New Zealand have GDPR adequacy status?

Yes. New Zealand has held EU adequacy status since the original European Commission decision in 2012. Following a review finalized on January 15, 2024, the Commission confirmed that New Zealand continues to provide an adequate level of data protection for personal data transferred from the EEA, taking into account the Privacy Act 2020, the updated IPP 12 cross-border transfer rules, and the strengthened powers of the OPC.

Is there a right to erasure under New Zealand privacy law?

No. Unlike the GDPR's Article 17 right to erasure, the Privacy Act 2020 does not give individuals the right to demand deletion of their personal information. Individuals have rights of access and correction under IPPs 6 and 7, and the retention principle in IPP 9 requires agencies to delete information they no longer need. Privacy Commissioner Webster has called for a right to erasure to be introduced in a future legislative reform, but it does not exist in the current Act.

How can an individual complain about a privacy breach?

Individuals should first raise the concern directly with the agency involved. If unresolved, they can lodge a free complaint with the Office of the Privacy Commissioner online. The Commissioner investigates and attempts settlement. If settlement fails or the Commissioner closes the complaint, the individual has six months to file a claim before the Human Rights Review Tribunal.

What are the key IPP 3A notification exemptions for businesses?

The exceptions sit in IPP 3A(3) to (7) and this is not a closed list. The broadest is IPP 3A(4)(a): the agency believes on reasonable grounds that non-compliance would not prejudice the interests of the individual concerned. The others businesses most often rely on are that the individual was already made aware of the matters; the information is publicly available; non-compliance is necessary to avoid prejudice to the maintenance of the law, to enforce a law imposing a pecuniary penalty, to protect public revenue, or for court or tribunal proceedings; compliance would prejudice the purposes of the collection; compliance would cause a serious threat to public health or safety, or to another individual's health or safety; the information will not be used in identifying form, or is for statistical or research use not published in identifying form; compliance is not reasonably practicable; the information is being assessed for public-interest archiving (IPP 3A(5)); or compliance would disclose a trade secret or unreasonably prejudice a commercial position (IPP 3A(7)).

Next Steps and Further Reading

For organisations assessing their compliance position under the Privacy Act 2020 as amended, the Office of the Privacy Commissioner's resources are the primary reference point. The OPC publishes guidance on each IPP, the BPPC, the NotifyUs breach notification portal, decision notes from concluded investigations, and the IPP 12 Decision Tree for cross-border transfers. The Ministry of Justice maintains background material on the IPP 3A reform and the policy intent behind the Privacy Amendment Act 2025.

For recording law and surveillance-specific questions under New Zealand law, see New Zealand Recording Laws.

Disclaimer

This article presents general legal information about New Zealand's data protection framework under the Privacy Act 2020, the Privacy Amendment Act 2025, and the Biometric Processing Privacy Code 2025. It does not constitute legal advice and does not create a solicitor-client relationship. The law described reflects statutes and regulatory guidance as of September 9, 2026. Organisations and individuals seeking advice about their specific privacy obligations should consult a lawyer licensed in New Zealand. The Office of the Privacy Commissioner's website at privacy.org.nz also provides free guidance and a complaints process.

About the Author

[PLACEHOLDER: author roster pending.]

Authorities Cited

1. Privacy Act 2020 (NZ), No 31. https://www.legislation.govt.nz/act/public/2020/31/en/latest/
2. Privacy Amendment Act 2025 (NZ), No 53. https://www.legislation.govt.nz/act/public/2025/53/en/latest/
3. Office of the Privacy Commissioner, "Information Privacy Principles." https://www.privacy.org.nz/privacy-act-2020/privacy-principles/
4. Office of the Privacy Commissioner, "IPP3A: Collection of personal information from another source." https://www.privacy.org.nz/resources-and-learning/a-z-topics/ipp3a/
5. Ministry of Justice (NZ), "Enhancing the Privacy Act." https://www.justice.govt.nz/justice-sector-policy/key-initiatives/enhancing-the-privacy-act/
6. Office of the Privacy Commissioner, Biometric Processing Privacy Code 2025. https://www.privacy.org.nz/privacy-principles/codes-of-practice/biometric-processing-privacy-code/
7. Office of the Privacy Commissioner, "Inquiry into Foodstuffs North Island trial use of facial recognition technology" (June 4, 2025). https://www.privacy.org.nz/resources-and-learning/public-inquiries/inquiry-into-foodstuffs-north-island-trial-use-of-facial-recognition-technology/
8. Privacy Act 2020, Part 6 (Notifiable Privacy Breaches). https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23530.html
9. Office of the Privacy Commissioner, "Sorting Out Privacy Breaches." https://www.privacy.org.nz/responsibilities/privacy-breaches/
10. Office of the Privacy Commissioner, "Sending Information Overseas (IPP 12)." https://www.privacy.org.nz/responsibilities/disclosing-personal-information-outside-new-zealand/
11. Office of the Privacy Commissioner, "New Zealand–EU Data Protection Adequacy." https://www.privacy.org.nz/privacy-principles/reports-on-new-zealand-adequacy-to-the-european-commission/
12. European Commission, "Report on the first review of the functioning of the adequacy decisions adopted pursuant to Article 25(6) of Directive 95/46/EC" (January 15, 2024). https://commission.europa.eu/document/f62d70a4-39e3-4372-9d49-e59dc0fda3df_en
13. Privacy Act 2020, s 118 (Offence to fail to notify Commissioner). https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23508.html
14. Office of the Privacy Commissioner, "What Are Your Privacy Rights?" https://www.privacy.org.nz/your-rights/your-privacy-rights/
15. Office of the Privacy Commissioner, "New Zealand needs Privacy Act modernisation" (November 13, 2025). https://www.privacy.org.nz/tuhono-connect/statements-media-releases/new-zealand-needs-privacy-act-modernisation-and-nbsp/
16. New Zealand Gazette, "Notice of Consultation on Proposed Amendments to Privacy Act 2020 Codes of Practice" (2026). https://gazette.govt.nz/notice/id/2026-au42
17. Ministry of Justice (NZ), "Human Rights Review Tribunal." https://www.justice.govt.nz/tribunals/human-rights/
18. Office of the Privacy Commissioner, Biometric Processing Privacy Code 2025, consolidated version as at 1 May 2026 (incorporating Amendment No 1). https://www.privacy.org.nz/assets/Codes-of-Practice-2020/Biometrics-Processing-Privacy-Code-2025-website-version.pdf
19. Office of the Privacy Commissioner, "Compliance Notice Guidelines." https://www.privacy.org.nz/assets/New-order/Resources-/Publications/Statements-and-media-releases/2.-Compliance-Notice-Guidelines.pdf
20. Office of the Privacy Commissioner, "Prosecution Policy." https://www.privacy.org.nz/about-us/opc-policies/prosecution-policy-2/
21. Office of the Privacy Commissioner, Annual Report of the Privacy Commissioner 2025. https://www.privacy.org.nz/about-us/corporate-reports/annual-reports/annual-report-of-the-privacy-commissioner-2025/
22. Office of the Privacy Commissioner, "Principle 3A: Collection of information from another source." https://www.privacy.org.nz/privacy-principles/3a/
23. Office of the Privacy Commissioner, "Principle 12: Disclosure outside New Zealand." https://www.privacy.org.nz/privacy-principles/12/
24. Office of the Privacy Commissioner, "Who we are" (list of Privacy Commissioners). https://www.privacy.org.nz/about-us/who-we-are/

Related Articles

• New Zealand Recording Laws
• World Data Privacy Laws Hub
• New Zealand Law Guide
• Australia Data Privacy Laws
• GDPR Overview

---

Last updated: 2026-09-09. Statutes cited reflect their in-force versions as of 2026-09-09.