New Zealand’s Privacy Act 2020 is principles-based and applies to overseas businesses carrying on business in New Zealand. Serious privacy breaches must be notified.
From 1 May 2026, a new principle (IPP 3A) requires agencies to tell people when they collect their information from someone else, which affects data enrichment, referrals and background checks.
- Core data law
- Privacy Act 2020
- Regulator
- Office of the Privacy Commissioner
- Breach notice
- Notifiable privacy breaches, as soon as practicable
- New
- IPP 3A indirect collection notices from 1 May 2026
- Marketing
- Unsolicited Electronic Messages Act 2007
- Penalties
- Fines up to NZ$10,000 for offences; compliance notices
Who needs to comply
Businesses with a New Zealand presence or carrying on business there
The Act applies to overseas agencies carrying on business in New Zealand.
Businesses collecting data from third parties
IPP 3A requires notice to the individual when information is collected indirectly.
The laws, in detail
01Privacy Act 2020
Thirteen information privacy principles, breach notification and cross-border disclosure.
When it applies
Agencies in New Zealand, and overseas agencies carrying on business there.
What you must do
- Collection, notice, security, access and correction under the IPPs
- Notify the Commissioner and affected people of serious-harm breaches
- Safeguards for overseas disclosures (IPP 12)
- IPP 3A notice for indirect collection from 1 May 2026
Regulator
Office of the Privacy Commissioner
Penalties
Compliance notices, Human Rights Review Tribunal damages and fines up to NZ$10,000 for offences.
02Unsolicited Electronic Messages Act 2007
Commercial emails and texts.
When it applies
Sending commercial electronic messages with a New Zealand link.
What you must do
- Consent
- Sender identification
- Functional unsubscribe
Regulator
Department of Internal Affairs
Penalties
Civil penalties.
03Harmful Digital Communications Act 2015
Harmful online communications and a safe-harbour process for online content hosts.
When it applies
Online content hosts and users in New Zealand.
What you must do
- Complaints process to keep safe harbour
- Respond to notices within 48 hours
Regulator
Netsafe; courts
Penalties
Orders and criminal offences.
04Fair Trading Act 1986
Misleading conduct, unsubstantiated claims and unfair contract terms in consumer and small business contracts.
When it applies
Businesses trading with New Zealand customers.
What you must do
- Substantiate claims about products, privacy and AI
- Avoid unfair standard-form terms
Regulator
Commerce Commission
Penalties
Fines and orders.
05Customer and Product Data Act 2025
A consumer data right enabling secure sharing of customer data with accredited requestors.
When it applies
Designated sectors, starting with banking.
What you must do
- Respond to authorised data requests in designated sectors
- Accreditation for data requestors
Regulator
Ministry of Business, Innovation and Employment
Penalties
Penalties under the Act once designations apply.
Compliance checklist
01 · Before you launch
- Privacy statement aligned with the IPPs
- Check IPP 12 for overseas disclosures
02 · At launch
- Breach notification process
- IPP 3A notices for indirectly collected data
03 · As you scale
- Review AI use under the Commissioner’s guidance
- Marketing consent records
Key dates
- 1 Dec 2020Privacy Act 2020 in force
- 23 Sep 2025Privacy Amendment Act 2025 assented
- 1 May 2026IPP 3A in force
Common mistakes
- No notice for data obtained from partners or enrichment vendors
- Late breach notification
FAQs
Does the Act apply to foreign SaaS companies?
It can, if they carry on business in New Zealand, even without a local office.
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.