New Zealand
SubstantialPrivacy Act 2020
Authority: Office of the Privacy Commissioner | Enforcement: Active | Enacted: December 2020
Overview
New Zealand's Privacy Act 2020 replaced the 1993 Act. It introduced mandatory breach notification, cross-border disclosure requirements, and compliance notices. New Zealand has EU adequacy status.
14-Topic Coverage
Data Protection Authority
Fully AddressedPrivacy Commissioner investigates complaints and issues compliance notices.
Consent Requirements
Fully AddressedCollection must be lawful, necessary, and with individual awareness. 13 Information Privacy Principles.
Data Subject Rights
Fully AddressedRights to access and correction under the Privacy Principles.
Cross-Border Transfer
Fully AddressedDisclosure to overseas agencies requires comparable protections.
Breach Notification
Fully AddressedMandatory notification to Commissioner and affected individuals if serious harm likely.
DPO Requirements
Partially AddressedPrivacy officer designation encouraged but not mandatory.
Children's Data
Partially AddressedGeneral provisions apply. No specific age threshold.
Penalties & Enforcement
Fully AddressedFines up to NZD 10,000. Compliance notices and Human Rights Review Tribunal.
Sector-Specific Rules
Fully AddressedHealth Information Privacy Code, Credit Reporting Privacy Code.
Cookie/Tracking
Not AddressedNo specific cookie regulation.
AI & Automated Decisions
Partially AddressedAlgorithm charter for government. No private sector AI law.
Data Localisation
Not AddressedNo data localisation requirement.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Fully AddressedPrivacy Act applies equally to government agencies. OIA provides information access.
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate New Zealand's regulations.
Book a Consultation