Privacy

Data privacy in New Zealand is governed by the Privacy Act 2020 (Privacy Act). The Privacy Act sets out how individuals and organisations (both public and private) can collect, hold, use, and disclose personal information. Personal information means any information about an identifiable individual (for instance, an individual’s name, address, financial information, or health details). 

Any organisation carrying out business in New Zealand, providing services to New Zealanders, and/or collecting their personal information for its own purposes, is subject to the Privacy Act.

The Privacy Act contains a set of information privacy principles. These information privacy principles provide the substantive requirements for collecting and using personal information and are similar to the information privacy regime in Australia.

Broadly, they are as follows:

1. Data minimisation - only collect information necessary for your lawful purpose and nothing more
2. Source of information - collect the information directly from the individual concerned
3. Transparency - when collecting information directly from the individual, make the individual aware of a number of elements including why the information is being collected; and when collecting personal information indirectly, take reasonable steps as soon as reasonably practicable after collection to ensure the individual is aware of specified matters, unless an exception applies
4. Manner of collection - collect the information in a fair and lawful way without being unreasonably intrusive
5. Security - implement security safeguards to protect the information from being lost, misused, or disclosed
6. Access - individuals have the right to access their personal information
7. Correction - individuals are entitled to request corrections to their personal information
8. Accuracy - take reasonable steps to ensure the personal information is current, complete, and not misleading
9. Storage limitation – ensure personal information is not held longer than necessary
10. Use of personal information – only use personal information for the purpose it was collected
11. Disclosure limitation – keep personal information confidential unless permitted to disclose it under the Privacy Act
12. Transfer of personal information outside Aotearoa New Zealand – disclose personal information outside New Zealand only if the required statutory safeguards under the Privacy Act are in place
13. Unique identifiers – ensure unique identifiers used by other companies are not replicated (for instance, requiring an individual to use their tax number to identify them to you)

All organisations carrying on business in New Zealand¹ (and subject to the Privacy Act) must appoint a privacy officer - a person who will ensure the organisation is compliant with the Privacy Act. 

The New Zealand Office of the Privacy Commissioner (OPC) is responsible for monitoring and enforcing compliance with the Privacy Act. The Privacy Act requires organisations to notify the OPC where there has been a notifiable privacy breach (for instance, a cyber attack or an incident which means that personal information has been lost or exposed and this has caused, or is likely to cause, serious harm). OPC guidance is that this notification should happen within 72 hours. You may also be required to notify the individuals who have been impacted by a privacy breach. Failure to report a notifiable privacy breach to the OPC without reasonable excuse is a criminal offence, with a maximum fine of NZ$10,000.

Complaints about a breach of the Information Privacy Principles are investigated by the OPC and may be referred to the Director of Human Rights Proceedings (DHRP) if the matter is not able to be resolved by the OPC. The DHRP has the ability to bring the matter before the Human Rights Review Tribunal (Tribunal) and the Tribunal can award damages for a breach of privacy (up to a maximum of NZ$350,000). The Privacy Act allows a class action mechanism for individuals impacted by a breach of privacy. Using this mechanism, a representative may bring a class action to the Tribunal for an interference with their privacy on behalf of a class of individuals.

The Customer and Product Data Act 2025 established a Consumer Data Right (CDR) framework in New Zealand.

CDR means consumers can now request that their personal data, as well as product data, is securely shared with trusted third parties. With greater control over their data, consumers can more easily make decisions about how and where they spend, save and invest.

The Customer and Product Data Act 2025 creates a common legal framework, and then the Government applies it sector by sector through separate designation regulations and sector standards. Banking is the first sector to be formally designated, and the relevant banking standards came into force on 1 December 2025. The development of CDR in the banking sector is anticipated to open up opportunities for new financial technology companies to enter the market as 'accredited requesters'. This development provides competition, not only for the services currently offered by banks, but also new and innovative services.

 The Government has decided to designate the retail electricity sector as the next sector under the CDR. The detailed regulations and standards are being developed in 2026, with regulated 'open electricity' expected to become fully operational from mid-2027.