New Zealand. Comprehensive data protection. Act
Privacy Act (NZ)Privacy Act 2020
In force
§1Summary
- Synopsis
New Zealand's principles-based privacy law with 13 Information Privacy Principles (plus IPP 3A), mandatory notification of serious breaches and Commissioner compliance notices. Codes of practice can modify the principles for sectors or data types.
- Key themes
- Unique features
Applies to overseas agencies carrying on business in NZ even without physical presence; low criminal fines but Tribunal damages.
- SaaS relevance
Foreign SaaS carrying on business in NZ is covered; cloud providers acting purely as agents are treated as holding data for the principal.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- OPC and individuals as soon as practicable where serious harm likely (guidance: 72h)
- DPO
- Yes
- Cross-border transfers
- IPP 12: comparable safeguards, model clauses, consent, prescribed countries/schemes
- Maximum penalty
- NZ$10,000 fine per offence; Human Rights Review Tribunal damages
§3Dates
- Key dates
- Adopted
- In force
- Privacy Amendment Act 2025 adds IPP 3A from 2026-05-01; Statutes Amendment Act 2025 tweaks complaint discretion
§4Text and authority
- Text
- Authoritative text legislation.govt.nz
- Authority
- Office of the Privacy Commissioner (OPC)
§5Where it applies
- Domestic law of
- New Zealand
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Privacy officer required (s 201). EU adequacy reconfirmed January 2024.