Meet the NZ Privacy Act 2020 with evidence, not spreadsheets

The Privacy Act 2020 is New Zealand's main privacy law. It came into force on 1 December 2020, replacing the Privacy Act 1993, and sets information privacy principles covering how personal information is collected, stored, used, disclosed, accessed and corrected. It also introduced mandatory notification of serious privacy breaches and compliance notices, enforced by the Office of the Privacy Commissioner.

Almost every agency that handles personal information must comply, including government bodies, businesses, not-for-profits and individuals acting in a business capacity, with no size threshold. Overseas organisations are also covered for actions taken while carrying on business in New Zealand, even if they have no office there and the information is held offshore.

The information privacy principles (IPPs) are the core rules in section 22 of the Act. There are 13 original principles plus IPP 3A, added by the Privacy Amendment Act 2025. They cover purpose and source of collection, notice to individuals, fair collection, security, access, correction, accuracy, retention, use, disclosure, overseas disclosure and unique identifiers.

IPP 3A requires agencies that collect personal information from someone other than the individual to take reasonable steps to tell the individual about the collection, its purpose, the intended recipients and their rights of access and correction. It came into force on 1 May 2026 and applies only to information collected from that date, with exceptions similar to IPP 3.

An agency must notify the Privacy Commissioner and affected individuals as soon as practicable after becoming aware of a privacy breach that it reasonably believes has caused, or is likely to cause, serious harm. Factors include the sensitivity of the information, the nature of the harm and any action taken to reduce it. Failing to notify the Commissioner is an offence.

Certain offences, such as failing to notify the Commissioner of a notifiable breach, misleading an agency to obtain personal information or ignoring a compliance notice, can lead to a fine of up to NZ$10,000. Individuals can also complain to the Privacy Commissioner, and the Human Rights Review Tribunal can award damages for interference with privacy.

Both are principles-based laws requiring a lawful purpose, transparency, security, access and correction rights, and breach notification. The NZ Act generally uses lower penalties, has no general consent requirement or right to erasure, and is complaints-driven. New Zealand holds an EU adequacy decision, so GDPR controls you already operate will cover much of the Act.

Yes, on request. The NZ Privacy Act 2020 is mapped in OneClickComply's control library and available on request rather than as a live framework today. Once enabled, controls and evidence you already hold for ISO 27001, GDPR or SOC 2 count towards the Act, and our in-house audit team can advise on the principles.