New Zealand

New Zealand's data-protection regime is anchored in the Privacy Act 2020, which repealed and replaced the Privacy Act 1993 and entered into force 1 December 2020, overseen by the Office of the Privacy Commissioner (OPC). The regime is principles-based (13 Information Privacy Principles), has extraterritorial reach for overseas agencies 'carrying on business' in NZ, and was amended in 2025 (Privacy Amendment Act 2025, Royal Assent 23 September 2025) to add IPP3A on indirect-collection notification. There is no general controller registration/filing obligation, consistent with the Act's light-touch, principles-based design.

New Zealand's regime does not use a GDPR-style enumerated 'lawful basis' menu or treat consent as a central organising principle. Collection is instead governed by necessity/purpose principles (IPP1-IPP4). The Act does not define statutory special/sensitive categories of data, though the OPC has issued non-binding guidance on 'sensitive personal information' and sector-specific codes (Health Information Privacy Code, Biometric Processing Privacy Code) impose heightened rules for particular data classes. Pseudonymisation/anonymisation are not defined in the Act.

Individuals have an access right (IPP6) and correction right (IPP7), with a statutory 20-working-day response window (extendable on reasonable grounds) enforceable via OPC binding access determinations/enforceable access directions. The Act does not provide a standalone right to erasure ('right to be forgotten'), restriction, objection, or portability comparable to GDPR Arts 16-21, a gap the OPC's own children's-privacy consultation has flagged for possible reform.

Agencies must appoint one or more privacy officers (internal or external) and maintain reasonable security safeguards (IPP5) and retention limits (IPP9). Part 6 of the Act creates a mandatory notifiable-privacy-breach regime (OPC + affected individuals, for breaches causing or likely to cause serious harm), detailed further in the Privacy Regulations 2020. There is no mandatory DPIA requirement (only non-binding OPC guidance recommending PIAs), no explicit ROPA obligation, and no direct statutory security obligation on processors/third-party service providers equivalent to GDPR Art 28 — a gap highlighted by the OPC's own Manage My Health (MMH) breach inquiry, which recommended amending the Act to make third-party service providers directly liable for security failures.

IPP12 (introduced by the 2020 Act) governs overseas disclosure of personal information, permitting transfer where the receiving agency is subject to comparable safeguards, via individual authorisation, prescribed binding schemes, or OPC-published model contract clauses. New Zealand itself holds EU adequacy status, originally granted under Directive 95/46/EC in December 2012 and reaffirmed as continuing in the European Commission's January 2024 review of 11 adequacy decisions. No data-localisation mandate or formal transfer-impact-assessment requirement was identified.

Sector-specific overlays operate via OPC-issued binding codes of practice that adapt the IPPs to particular data classes or industries. The Health Information Privacy Code (HIPC) governs health-sector personal information (its Rule 5 security requirement was central to the 2025/2026 Manage My Health breach findings). A Credit Reporting Privacy Code and Telecommunications Information Privacy Code are understood to exist but were not independently verified in this research pass. Employment data is subject to the general IPPs without a dedicated employment code identified. Education and insurance sector-specific overlays were not identified in this pass.

No NZ-specific cookie/tracker consent regime, dark-pattern prohibition, recognised opt-out signal (e.g. GPC), clean-room framework, or CPRA-style 'sale/share' concept was identified; the general Privacy Act IPPs apply to any online collection of personal information but do not create adtech-specific rules. A dedicated direct-marketing/anti-spam statute may exist in New Zealand but was not verified in this research pass.

New Zealand has no standalone AI statute; the OPC has instead issued guidance (June and October 2023) applying the 13 IPPs to AI systems, recommending PIAs, senior-leadership approval, transparency, human review, and consideration of Te Ao Māori perspectives. Commissioner Michael Webster has publicly called for clearer automated-decision-making rules and a financial penalty regime to better govern AI risk. Biometric processing is now regulated via the OPC's binding Biometric Processing Privacy Code (issued 6 August 2025), which imposes necessity/proportionality assessments and notice obligations across the biometric information lifecycle, while excluding consumer devices and health-agency biometric processing (covered by the Health Information Privacy Code). No Art 22 GDPR-style profiling restriction, genetic-data regime, or codified state-surveillance carve-out framework was substantiated.

New Zealand's Privacy Act does not contain a GDPR Art 8/COPPA-style parental-consent regime or a general age-of-consent threshold for data processing. Age 16 is used only as a narrower ground allowing an agency to withhold information from (or about) a requester under that age where release would be contrary to their interests, a ground extended by the Privacy Amendment Act 2025. The OPC's children's privacy consultation has surfaced options — a 'best interests of the child' obligation and a child-specific right to be forgotten — that are under discussion but not yet enacted. No minor-profiling ban, education-settings-specific rule, or dependent-adults regime was substantiated.

The OPC can issue compliance notices and binding/enforceable access directions, and can investigate complaints, but criminal offences under the Act (e.g., failure to notify a serious breach, misleading an agency, destroying requested information) carry a maximum fine of only NZD10,000, and there is no general civil-penalties regime for breaches of the information privacy principles themselves. The Human Rights Review Tribunal (HRRT) can award damages (e.g., NZD50,000 against ACC in 2020; reported ceiling around NZD350,000), but access requires OPC referral or a decision not to investigate, and claims must be filed within six months of a Section 98 notice. Enforcement activity has intensified: the OPC's 2024-25 Annual Report recorded a 43% rise in notified serious breaches, and its 2025/2026 Phase 1 inquiry into the Manage My Health breach recommended compliance notices, a centralised health-sector supplier verification programme, and legislative amendments for third-party liability. The Commissioner and commentators are actively campaigning for a financial penalties regime, referencing Australia's AUD50 million maximum penalty as a comparator; NZ's Cyber Security Strategy 2026-2030 (published 27 February 2026) is cited as a first concrete sign of possible reform.