Privacy Act 2020

· About Privacy Act 2020

Key Takeaways

  • The Privacy Act 2020 applies to most agencies that collect, hold, use, or disclose personal information in New Zealand, and it is enforced by the Office of the Privacy Commissioner.[1][8]
  • The Act originally came into force on 1 December 2020, and the most important 2025–2026 change is the Privacy Amendment Act 2025, which inserted IPP 3A for indirect collection and brought it into force on 1 May 2026.[3][8]
  • IPP 3A requires an agency that collects personal information from someone other than the individual to take reasonable steps to ensure the individual is informed of specified matters, aligning the rule more closely with direct-collection notice obligations under IPP 3.[1][8]
  • The Act gives the Privacy Commissioner stronger enforcement tools, including compliance notices and access directions, and it also creates offences with higher potential fines for certain breaches.[6]
  • The Act has extraterritorial reach where an overseas agency is involved through cross-border disclosure, because New Zealand organisations must ensure overseas recipients meet the Act’s protection standard or obtain informed authorisation from the individual.[6][13]
  • The Privacy Act 2020 remains in force as amended, and the 2025 technical changes and the 2026 IPP 3A change are the key current milestones that compliance teams should map into their privacy programmes.[4][8]

What It Is

The Privacy Act 2020 is New Zealand’s comprehensive privacy statute governing the collection, use, storage, disclosure, correction, and access of personal information by agencies, including businesses and public-sector bodies.[8][9] It is administered and enforced by the Office of the Privacy Commissioner, which regulates compliance, issues guidance, and handles complaints.[11][15]

The Act was adopted on 30 June 2020 as the Privacy Act 2020 and came into force on 1 December 2020.[7][9] The main 2025–2026 amendment package is the Privacy Amendment Act 2025, which received Royal Assent on 23 September 2025 and made technical amendments effective on 24 September 2025 and the new IPP 3A effective on 1 May 2026.[8][4]

A key phase-in point is that IPP 3A does not apply retrospectively to personal information collected before 1 May 2026.[4] The current law therefore combines the original 2020 framework with the 2025 amendment changes now fully in force.[1][4]

Who Must Comply

The Act applies to most agencies, which is the Act’s broad term for bodies that collect or handle personal information in the course of activities in New Zealand.[9][11] That includes private businesses, public agencies, and many organisations operating in New Zealand, subject to specific statutory exceptions.[9]

The Act’s reach is practical rather than purely territorial, because cross-border disclosure is regulated: a New Zealand agency may disclose personal information overseas only where the recipient offers a comparable level of protection or the individual has been fully informed and authorised the transfer.[6][13] In that sense, the Act has an extraterritorial effect on overseas recipients that receive New Zealand personal information through covered disclosures.[6]

Important exemptions and carve-outs exist, including certain historical records and specialised statutory regimes. The 2025 amendment text also confirms that IPP 3A does not apply to personal information collected before 1 May 2026.[4] The Consumer Protection guidance further notes that some activities are outside the Act where separate legislation, such as the Consumer Data Right regime, applies.[2]

Core Requirements

  1. Collect personal information fairly and lawfully. Agencies must collect personal information only in ways that comply with the Act’s information privacy principles and are not misleading or unfair in context.[9][14]
  1. Give notice at collection. When collecting directly from the individual, an agency must provide the required notice information under IPP 3; when collecting indirectly, IPP 3A now requires reasonable steps to inform the individual of the specified matters.[1][8]
  1. Use and disclose only for authorised purposes. Personal information must be used or disclosed consistently with the purpose for which it was collected, unless a lawful exception applies under the Act.[9][14]
  1. Protect personal information appropriately. Agencies must take reasonable security safeguards to prevent loss, misuse, unauthorised access, modification, or disclosure of personal information.[14]
  1. Control cross-border transfers. Before sending personal information outside New Zealand, the agency must ensure the overseas recipient has comparable safeguards or obtain informed authorisation from the individual.[6][13]
  1. Provide access and correction rights. Individuals have rights to access their personal information and request correction, and the Privacy Commissioner may deal with complaints relating to access decisions.[6][9]
  1. Support unique identifier controls. The Act includes specific rules limiting misuse of unique identifiers and requiring reasonable steps to prevent misuse.[6][14]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Privacy Act 2020 in force | 1 December 2020 | Core privacy framework and principles begin applying.[7][9] | | Technical amendments in force | 24 September 2025 | Minor fixes and technical amendments from the 2025 amendment package take effect.[8][4] | | IPP 3A in force | 1 May 2026 | Indirect-collection notice obligations apply to new collections from this date.[1][8] |

The Privacy Act 2020 gives the Commissioner stronger enforcement powers, including compliance notices and access directions, and it introduces offences with greater penalties for certain conduct.[6] Public guidance summarising the Act states that the Act now allows fines of up to NZ$10,000 for some offences, though the exact penalty depends on the offence charged and the court outcome.[6]

Other sanctions can include binding compliance action, compelled disclosure or correction-related orders through the Commissioner’s processes, and reputational consequences from regulatory findings.[6][11] Organisations should also expect complaint handling, investigation, and remedial directions where processing practices do not meet the Act’s standards.[11][15]

How to Comply

  1. Map your data flows and lawful bases. Identify what personal information you collect, from whom, where it is stored, and when it is disclosed, then align each flow with the relevant privacy principle and purpose limitation.
  1. Update notices for direct and indirect collection. Revise privacy notices, forms, call scripts, and vendor workflows so IPP 3 and IPP 3A notices are accurate, timely, and operationally usable.
  1. Build a security control baseline. Use ISO 27001 as the management-system backbone for access control, logging, incident response, supplier assurance, and risk treatment, because the Act expects reasonable safeguards.
  1. Tie privacy governance to risk management. Use NIST CSF 2.0 to structure identify-protect-detect-respond-recover activities for personal information handling, especially where data incidents, third-party access, or cross-border transfers are material.
  1. Formalise privacy-by-design governance. Use ISO 42001 where AI systems process personal information, so model inventory, impact assessment, human oversight, and lifecycle controls are documented before deployment.
  1. Strengthen cross-border transfer controls. Require due diligence on overseas recipients, standard contractual protections where useful, and a documented decision path showing how comparable protection is satisfied.
  1. Train staff and test response playbooks. Train operational teams on access, correction, breach escalation, and indirect-collection notice rules, then run periodic tabletop exercises and audits.

Related Regulations

Consumer Data Right legislation can displace or supplement the Privacy Act for covered open-data activities, so teams should confirm which regime governs a particular data flow.[2]

Health Information Privacy Code overlaps with the Act for health-sector processing and can impose more specific rules on health information handling than the general Act.

Credit Reporting Privacy Code applies alongside the Act to credit reporting activity and contains sector-specific rules that narrow or expand what a general privacy programme must do.

Public Records Act 2005 can affect retention and disposal of personal information held by public agencies, creating a compliance balance between privacy minimisation and lawful recordkeeping.

Overseas Privacy regimes such as GDPR may apply simultaneously where New Zealand organisations process data of individuals in the EU, requiring dual-track compliance on notice, transfers, and rights handling.

FAQ

Does the Privacy Act 2020 apply to companies outside New Zealand?

Yes, if an overseas company receives New Zealand personal information through a covered disclosure or otherwise operates in a way that is captured by the Act’s practical reach. The most direct extraterritorial issue is cross-border disclosure: New Zealand organisations must only send personal information overseas where the recipient has comparable protection or the individual has been properly informed and authorised.[6][13]

What changed in 2025 and 2026?

The major change was the Privacy Amendment Act 2025, which inserted IPP 3A for indirect collection and brought it into force on 1 May 2026.[8] The amendment package also made technical fixes effective on 24 September 2025.[8][4]

Does IPP 3A apply to old personal information collected before May 2026?

No, the amendment text states that IPP 3A does not apply to personal information collected before 1 May 2026.[4] Organisations should still assess older data against the rest of the Act, but the new indirect-collection notice rule does not operate retrospectively.[4]

What are the penalties for non-compliance?

The Act gives the Privacy Commissioner stronger enforcement tools, including compliance notices and access directions, and it creates offences with increased fines.[6] Public guidance states that some offences can attract fines of up to NZ$10,000, depending on the breach and prosecution outcome.[6]

Do small businesses have to comply?

Usually yes, because the Act applies broadly to agencies that collect or handle personal information.[9][11] Small size does not by itself remove an organisation from the Act, although the practical compliance burden may be lighter if it handles limited, low-risk data.

Can individuals access and correct their data?

Yes, the Act preserves access and correction rights for individuals and gives the Commissioner a role in complaint handling where access decisions are disputed.[6][9] Organisations should have a documented process for identity verification, response timeframes, exemptions, and correction disputes.

Sources

Put it into practice

More compliance guides