What is New Zealand’s Privacy Act 2020?
The Privacy Act 2020 replaced the Privacy Act 1993 and modernised New Zealand’s privacy law. It is built on information privacy principles (IPPs) that apply to almost every person or organisation, in the public and private sectors, that handles personal information.
Who does it apply to?
“Agencies”: businesses, government bodies, community groups and individuals acting in a business capacity, with limited exceptions such as the news media in news activities. Overseas agencies carrying on business in New Zealand are covered for information collected or held in the course of that business.
The information privacy principles
They cover:
- purpose of collection;
- collection directly from the individual, and the manner of collection;
- transparency about collection;
- storage and security;
- access and correction;
- accuracy;
- retention;
- limits on use and disclosure;
- cross-border disclosure (IPP 12);
- unique identifiers.
An amendment adds a principle requiring notice to individuals when their information is collected indirectly. It applies from 2026; check the Commissioner’s guidance for the commencement date.
Notifiable privacy breaches
If a privacy breach has caused, or is likely to cause, serious harm, the agency must notify the Privacy Commissioner and affected individuals as soon as practicable. Failing to notify is an offence. The Commissioner provides an online tool, NotifyUs, to report breaches and assess seriousness.
Enforcement
The Commissioner can issue compliance notices and investigate complaints. The Human Rights Review Tribunal can award damages. Criminal fines apply for specific offences, such as misleading an agency to obtain information or failing to notify a breach.
How does it relate to other frameworks?
New Zealand holds an EU adequacy decision. Its principles-based approach is similar to Australia’s, but the two laws differ in scope, thresholds and breach rules.
Sources and official references
- Office of the Privacy Commissioner — Privacy Commissioner New Zealand (official source)
- Privacy Act 2020 — New Zealand Legislation (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with New Zealand; overseen by the Office of the Privacy Commissioner.
