--- title: "New Zealand Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/new-zealand/ source_html: /jurisdictions/new-zealand/index.html description: "New Zealand data protection and privacy regulation: 10 categories, 87 claims, updated 2026-11-04." generated_at: 2026-11-07T14:58:19Z content_sha256: 42410b6b643face8ab11770da8b74972cb39dd8f731554396bebe7b9df3a7117 generator: "fe-fleet/md-twin@1.0" --- # New Zealand Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # New Zealand Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: artificial-intelligence Last updated 2026-11-04 · 10 categories · 87 claims · 59 sources in the cumulative register Download report (PDF) Expand all New Zealand's privacy framework tightened on two fronts simultaneously this cycle. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: AdTech & Commercial Privacy. Not fully checked this cycle: Regulator & Framework, Controller/Processor Duties (3 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=NEW-ZEALAND)[Build Report](/reports/?j=NEW-ZEALAND)[Compare](/compare/?j=NEW-ZEALAND) Framework posture Regulated (omnibus) 9 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Office of the Privacy Commissioner (OPC) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 9 / 10 modules assessed 0 Confirmed · 9 Probable · 0 Uncertain · 1 Not yet assessed 10 Categories 1 Red categories 57 Sub-modules 87 Claims 1 Tier-1 sources Traffic-light mix 2 green 6 amber 1 n/a 1 red (sums to 10 rendered categories; click to filter) 1 category flagged red ## Jurisdiction brief Jurisdiction lead brief 1,200 Full executive summary 377 ###### Latest update · 25 October 2026 #### Lead Signal New Zealand's data protection settings moved on two fronts, and both point toward a tightening operating environment even though the statute itself has not changed. The Office of the Privacy Commissioner, headed by Michael Webster, continues to administer the Privacy Act 2020 as the country's single national data-protection authority, but the government's Cyber Security Action Plan 2026-2027 now proposes, at Action 8, that the Ministry of Justice advise on options including a civil pecuniary penalty regime for that Act. This is a policy proposal, not draft legislation, and the Act's current toolkit is unchanged, but it signals that the complaints-based model underpinning New Zealand enforcement is being reconsidered at a government-policy level. Alongside that signal, the compliance landscape for biometric processing shifted concretely: the nine-month transitional grace period the Biometric Processing Privacy Code 2025 gave to organisations already running biometric systems before 3 November 2025 expired on 3 August 2026. Those organisations must now comply in full with the Code's thirteen rules, with commentary noting reported low business awareness of the deadline having passed. #### Other Developments Rising breach-notification activity. Chambers and Partners' 2026 commentary reports a 47 percent rise in notifiable privacy-breach notifications to the Office of the Privacy Commissioner, with more than half involving serious harm, and private-sector notifications more than tripling. This is a volume signal rather than a statutory change, but it is the backdrop against which the civil-penalty proposal is being made. An emerging judicial remedy for stolen data. Three 2026 High Court decisions -- Neighbourly Ltd v Unknown Defendants, Manage My Health Ltd v Unknown Defendants, and Langley Twigg Partnership v Unknown Defendants -- establish a consistent framework in which the Court grants broad injunctive relief to prevent further disclosure or use of data stolen in cyberattacks. This gives affected organisations and, in principle, affected individuals a route to the High Court that sits outside the Office of the Privacy Commissioner's own complaints process, which otherwise relies on investigation and referral to the Human Rights Review Tribunal as its most serious consequence. The enforcement gap the proposal would address. The Office of the Privacy Commissioner currently has no direct administrative fining power. Its most serious available consequence remains a complaints-based investigation culminating, where warranted, in referral to the Human Rights Review Tribunal. The Cyber Security Action Plan's Action 8 proposal for Ministry of Justice advice on a civil pecuniary penalty regime is pitched directly at that gap, though it remains at the policy-proposal stage with no draft legislation yet in view. #### Cross-Monitor Connections The biometric compliance deadline and the proposed civil-penalty regime both have relevance beyond data protection narrowly conceived. Organisations assessing financial-crime and identity-verification exposure in New Zealand, tracked separately under financial-integrity monitoring, rely in part on the same biometric and identity-data infrastructure now subject to the Biometric Processing Privacy Code's full rule set. Payment-sector and fintech readers tracked under world-payments monitoring should also note that any future civil pecuniary penalty regime for the Privacy Act 2020 would sit alongside, not inside, New Zealand's financial-conduct and payments regulatory perimeter, and would apply to any data controller or processor regardless of sector. #### Outlook The Ministry of Justice's advice on a civil pecuniary penalty regime is expected around the second quarter of 2027, and the timeframe carries meaningful uncertainty given it spans a multi-year horizon from a policy commitment rather than an introduced Bill. Until that advice is given and, if accepted, translated into legislation, the Office of the Privacy Commissioner's enforcement toolkit remains unchanged in law even as breach-notification volumes and the new High Court injunctive-relief framework suggest growing practical pressure on the current model. Readers should also watch for any Privacy Commissioner guidance addressing the Biometric Processing Privacy Code's post-grace-period compliance expectations, given the reported gap between the rules now being fully in force and current business awareness of that fact. 5 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal New Zealand's privacy framework tightened on two fronts simultaneously this cycle. Information Privacy Principle 3A, introduced by the Privacy Amendment Act 2025, came into force on 1 May 2026, requiring agencies to notify individuals when personal information is collected indirectly - a change introduced specifically to close an indirect-collection gap the European Union identified during New Zealand's adequacy assessment, and intended to support New Zealand's continued EU adequacy status. At the same time, enforcement pressure is building against a statutory penalty ceiling increasingly viewed as inadequate: the Office of the Privacy Commissioner confirmed in May 2026 its intention to issue compliance notices against Manage My Health Limited and Health New Zealand for failing to protect health information under the Health Information Privacy Code, following a January 2026 data breach, while the Privacy Act 2020's maximum court-ordered fine remains capped at NZD $10,000. The Green Party responded on 10 June 2026 by proposing to raise maximum privacy-breach penalties to NZ$10 million for firms and NZ$500,000 for individuals. Together these developments show an enforcement posture tightening materially faster than the statutory penalty ceiling that is meant to back it. #### Other Developments Technical clarifications took effect ahead of IPP 3A. The Statutes Amendment Act 2025, in force from 27 November 2025, made technical clarifications to the Privacy Act 2020, including principal-agency liability and the Commissioner's discretion to investigate complaints - a lower-materiality development than IPP 3A but part of the same legislative tightening sequence. The Biometric Processing Privacy Code's grace period has expired. The Code's nine-month grace period for pre-existing biometric processing activities expired on 3 August 2026, meaning full compliance is now mandatory for biometric processing activities that predate the Code. The health-sector enforcement action remains unconfirmed in its final form. Whether the Office of the Privacy Commissioner has formally published the compliance notices against Manage My Health Limited and Health New Zealand remains unconfirmed at the time of research, even though the OPC's intention to issue them was confirmed in May 2026. #### Cross-Monitor Connections New Zealand's EU-adequacy-preservation motivation behind IPP 3A is a matter this monitor tracks directly through cross-border and adequacy analysis; it does not require separate escalation to another monitor, as the adequacy relationship runs between New Zealand and the European Union rather than through a payments, financial-integrity or crypto channel this cycle. No health-sector, biometric, or penalty-reform development this cycle was found to carry a material financial-integrity, payments, or crypto-asset dimension requiring a link-out to those monitors. #### Outlook The Green Party's 10 June 2026 proposal to raise maximum privacy-breach penalties to NZ$10 million for firms has not yet been formally introduced as a bill, and whether it progresses toward legislation is the central penalty-reform question to track. Equally important is whether the Office of the Privacy Commissioner formally publishes the compliance notices against Manage My Health Limited and Health New Zealand, which would convert a confirmed intention into a documented enforcement outcome. The convergence of IPP 3A's commencement, the Biometric Code's grace-period expiry, and this enforcement pressure together support the assessed judgement that New Zealand's privacy-enforcement posture is tightening materially faster than its statutory penalty ceiling, creating pressure for near-term legislative reform. Read full brief · 1200 words ###### Latest update · 18 October 2026 #### Regulatory Status New Zealand's privacy regulatory position tightened across several fronts this cycle. The Office of the Privacy Commissioner's Phase 1 inquiry findings, released 27 May 2026, found Manage My Health Limited and Health New Zealand breached Rule 5 of the Health Information Privacy Code in a December 2025 cyber incident affecting 99,416 patients, prompting the Commissioner to recommend direct processor liability reform and to issue compliance notices under section 123 of the Privacy Act 2020. Two lawful-processing obligations also reached milestones: Information Privacy Principle 3A entered force 1 May 2026, and the Biometric Processing Privacy Code's transition grace period for historical processing ended 3 August 2026. Separately, Consumer Data Right standards stewardship for banking transferred from Payments NZ's API Centre to MBIE on 30 September 2026. #### Outlook Whether the Commissioner's recommendation for direct processor liability and civil-penalty powers produces a legislative response remains the central open question for New Zealand's privacy framework, alongside how the October 2026 compliance notices against Manage My Health and Health New Zealand are resolved under the existing, limited enforcement toolkit. 2 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 #### Regulatory Status New Zealand's privacy-regulatory posture is tightening this cycle across framework, adequacy, sectoral, and enforcement dimensions. Information Privacy Principle 3A came into force on 1 May 2026, closing an indirect-collection gap the European Union identified during New Zealand's adequacy assessment and intended to support New Zealand's continued EU adequacy status. The Biometric Processing Privacy Code's grace period expired 3 August 2026. The Office of the Privacy Commissioner confirmed in May 2026 its intention to issue compliance notices against Manage My Health Limited and Health New Zealand over a health-data breach, and the Green Party responded on 10 June 2026 by proposing to raise the Privacy Act 2020's NZD $10,000 maximum fine to NZ$10 million for firms. None of the enforcement or penalty-reform threads has yet reached a confirmed final outcome. #### Outlook Whether the compliance notices are formally published, and whether the Green Party's penalty-reform proposal is introduced as a bill, are the two developments most likely to change New Zealand's privacy-regulatory risk assessment next cycle. Read full brief · 377 words Key regulatory facts for New Zealand Regulatory Dimension New Zealand Standing Position Jurisdiction New Zealand (NZ) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 87 sourced findings) Regulator & Framework Comprehensive, currently-in-force omnibus statute with an active single regulator and confirmed EU adequacy; amber-tilt reserved for scope/registration sub-modules given absence of certain GDPR-analogous mechanics. Lawful Processing & Special Data Core structural gaps versus GDPR analogues (no enumerated lawful bases, no statutory special categories, no anonymisation safe-harbour) justify amber despite functioning principle-based alternative. Data Subject Rights Access/correction/response-window mechanics are robust and enforceable, but erasure, restriction/objection, and portability rights are largely absent, warranting amber overall. Controller/Processor Duties Breach notification and security-of-processing duties are in force and actively enforced, but DPIA, ROPA, and processor-liability gaps (flagged by the regulator itself following the 2025/2026 MMH breach) justify... Primary Instruments Cited DataGuidance, DataGuidance, IAPP, Office of the Privacy Commissioner (via LiveNews press-release distribution), MLex Last Confirmed / Updated 2026-11-04 (59 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### New Zealand: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive, currently-in-force omnibus statute with an active single regulator and confirmed EU adequacy; amber-tilt reserved for scope/registration sub-modules given absence of certain GDPR-analogous mechanics. Primary framework Privacy Act 2020 (NZ) Supervisory authority [Office of the Privacy Commissioner (OPC)](https://www.privacy.org.nz/) Traffic-light rationale — Green Comprehensive, currently-in-force omnibus statute with an active single regulator and confirmed EU adequacy; amber-tilt reserved for scope/registration sub-modules given absence of certain GDPR-analogous mechanics. #### Sub-modules (5) #### Regulator And AuthorityGreen The OPC, led by Privacy Commissioner Michael Webster, is the statutory data protection authority referred to as 'the Commissioner' under the Act. Claims (5): - The Privacy Act established the Office of the Privacy Commissioner of New Zealand (OPC), which acts as the data protection authority and is referred to as 'the Commissioner' within the Privacy Act and the Privacy Act 2020. - The OPC does not hold GDPR-equivalent direct administrative fining powers. - The Office of the Privacy Commissioner, headed by Michael Webster, administers the Privacy Act 2020 as New Zealand's single national data-protection authority - The Office of the Privacy Commissioner administers the Privacy Act 2020 as New Zealand's single national data-protection authority. - Office of the Privacy Commissioner — OPC supervises the 13 Information Privacy Principles, receives mandatory breach notifications, and may issue binding codes of practice, access directions and compliance notices #### Act And InstrumentsGreen Primary instruments are the Privacy Act 2020, Privacy Regulations 2020, and the Privacy Amendment Act 2025; the OPC also issues binding codes of practice with the force of law. Claims (6): - On 1 December 2020, the OPC announced the entry into effect of the Privacy Act 2020, which repeals and replaces the 27-year-old Privacy Act 1993. - New Zealand's Privacy Amendment Act 2025 was signed into law and officially enacted after receiving Royal Assent on 23 September 2025, introducing new Information Privacy Principle 3A requiring notification when personal information is collected indirectly. - Information Privacy Principle 3A — IPP 3A came into force 1 May 2026, requiring notification of indirect collection. - Cyber Security Action Plan 2026-2027 — Action 8 proposes that the Ministry of Justice advise on options including a civil pecuniary penalty regime for the Privacy Act 2020; a policy proposal, not yet draft legislation - IPP3A does not apply retroactively to personal information collected before 1 May 2026. - Privacy Amendment Act 2025 — Royal Assent 23 Sept 2025; technical amendments effective 24 Sept 2025; IPP 3A notification obligation effective 1 May 2026 #### Material ScopeAmber The Act protects 'personal information' held by public and private sector 'agencies'; unlike the GDPR it does not define special categories of data or clearly delineate types of processing caught. Claims (1): - Unlike the GDPR, neither the Privacy Act 1993 nor the Privacy Act 2020 provide for special categories of data or clearly define what types of data processing fall under their scope. #### Territorial ScopeGreen The 2020 Act expanded territorial scope to overseas businesses/organisations 'carrying on business' in New Zealand even absent physical presence. Claims (3): - The Privacy Act 2020 has expanded extraterritorial scope, encompassing overseas businesses or organisations that 'carry on business' in New Zealand even if they do not have a physical presence in the country. - Privacy Act 2020 — The Privacy Act applies to actions taken by an overseas agency carrying on business in New Zealand, regardless of where the information is held or the individual is located. - Privacy Act 2020 — the Act explicitly applies to overseas-based entities carrying on business in New Zealand #### Regulator Registration And FilingAmber No general registration or filing regime for controllers/agencies was identified; the Act relies on principles-based compliance rather than registration. New Zealand's data-protection regime is anchored in the Privacy Act 2020, which repealed and replaced the Privacy Act 1993 and entered into force 1 December 2020, overseen by the Office of the Privacy Commissioner (OPC). The regime is principles-based (13 Information Privacy Principles), has extraterritorial reach for overseas agencies 'carrying on business' in NZ, and was amended in 2025 (Privacy Amendment Act 2025, Royal Assent 23 September 2025) to add IPP3A on indirect-collection notification. There is no general controller registration/filing obligation, consistent with the Act's light-touch, principles-based design. Periodic update · new data 2026-10-18 #### Regulator & Framework The Office of the Privacy Commissioner continues to lack direct administrative fining power under New Zealand's Privacy Act 2020, a structural feature of the regulatory framework that the Commissioner has now publicly flagged following the Manage My Health and Health New Zealand breach findings. The OPC's available enforcement toolkit is limited to compliance notices and referral toward a criminal offence, rather than the civil administrative-penalty regimes that regulators in comparable jurisdictions hold. This gap has moved from a background structural feature to an actively contested one, with the Commissioner publicly recommending reform rather than treating the limitation as settled. The framework otherwise continues to operate through the Privacy Act 2020 and its associated codes, including the Health Information Privacy Code and the Biometric Processing Privacy Code, administered by the OPC as New Zealand's sole data-protection regulator. #### Outlook Whether the Commissioner's public flagging of the fining-power gap translates into a government or Cabinet response is the development to watch for this module. 1 earlier distinct update(s) Periodic update · new data 2026-09-21 #### Regulator & Framework IPP3A, a new information privacy principle introduced by the Privacy Amendment Act 2025, came into force on 1 May 2026. It requires agencies to take reasonable steps to notify individuals when their personal information is collected indirectly from third-party sources, subject to a set of listed exceptions. This closes a notice gap in New Zealand's Privacy Act framework that most comparable regimes, including the EU's Article 14 GDPR notice obligation and Australia's APP 5, had already addressed, and it is confirmed with high confidence based on the Office of the Privacy Commissioner's own statement on the amendment's passage. The new obligation does not apply retroactively: it does not reach personal information collected before 1 May 2026. This transition-scope limitation is itself confirmed, drawn from the legislation's own published text, and it means the practical operational effect of IPP3A on agencies' existing data holdings will build progressively rather than applying to the full stock of previously collected personal information immediately upon commencement. The introduction of IPP3A is New Zealand's most significant framework-level privacy development in this cycle, extending the country's indirect-collection notice standard in a way that had been a recognised gap relative to peer jurisdictions. #### Outlook The practical operation of IPP3A, including how agencies interpret the listed exceptions to the notice obligation, has not yet been tested through any enforcement action or Office of the Privacy Commissioner guidance identified this cycle. Whether the Office issues interpretive guidance or takes any enforcement action specifically citing IPP3A in the coming cycle is the key framework-level watch item. Sources and claims (16) - [DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v_nz_privacy_acts.pdf) — The Privacy Act established the Office of the Privacy Commissioner of New Zealand (OPC), which acts as the data protection authority and is referred to as 'the Commissioner' within the Privacy Act and the Privacy Act 2020. - [DataGuidance](https://www.dataguidance.com/news/new-zealand-privacy-act-2020-enters-effect) — On 1 December 2020, the OPC announced the entry into effect of the Privacy Act 2020, which repeals and replaces the 27-year-old Privacy Act 1993. - [IAPP](https://iapp.org/news/a/nz-privacy-amendment-act-broadens-privacy-notification-obligation-to-meet-global-practice) — New Zealand's Privacy Amendment Act 2025 was signed into law and officially enacted after receiving Royal Assent on 23 September 2025, introducing new Information Privacy Principle 3A requiring notification when personal information is collected indirectly. - [DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v_nz_privacy_acts.pdf) — Unlike the GDPR, neither the Privacy Act 1993 nor the Privacy Act 2020 provide for special categories of data or clearly define what types of data processing fall under their scope. - [DataGuidance](https://www.dataguidance.com/news/new-zealand-privacy-act-2020-enters-effect) — The Privacy Act 2020 has expanded extraterritorial scope, encompassing overseas businesses or organisations that 'carry on business' in New Zealand even if they do not have a physical presence in the country. - [Office of the Privacy Commissioner (via LiveNews press-release distribution)](https://livenews.co.nz/2026/10/30/final-report-into-manage-my-health-inquiry-a-wake-up-call-for-agencies/) — The OPC does not hold GDPR-equivalent direct administrative fining powers. - [MLex](https://www.mlex.com/mlex/data-privacy-security/articles/2544354) — Information Privacy Principle 3A — IPP 3A came into force 1 May 2026, requiring notification of indirect collection. - [Office of the Privacy Commissioner](https://www.privacy.org.nz/privacy-principles/) — The Office of the Privacy Commissioner, headed by Michael Webster, administers the Privacy Act 2020 as New Zealand's single national data-protection authority - [MinterEllisonRuddWatts](https://minterellison.co.nz/insights/government-releases-new-zealand-cyber-security-action-plan) — Cyber Security Action Plan 2026-2027 — Action 8 proposes that the Ministry of Justice advise on options including a civil pecuniary penalty regime for the Privacy Act 2020; a policy proposal, not yet draft legislation - [Office of the Privacy Commissioner (via LiveNews press-release distribution)](https://livenews.co.nz/2026/10/30/final-report-into-manage-my-health-inquiry-a-wake-up-call-for-agencies/) — Manage My Health Ltd / Health NZ — OPC's final (Phase 2) report, released 30 October 2026, confirms both Manage My Health Ltd and Health NZ breached Rule 5 of the Health Information Privacy Code by failing to maintain reasonable security safeguards; compliance notices issued to both. - [Office of the Privacy Commissioner (via LiveNews press-release distribution)](https://livenews.co.nz/2026/10/30/final-report-into-manage-my-health-inquiry-a-wake-up-call-for-agencies/) — The Office of the Privacy Commissioner administers the Privacy Act 2020 as New Zealand's single national data-protection authority. - [MLex](https://www.mlex.com/mlex/data-privacy-security/articles/2544354) — IPP3A does not apply retroactively to personal information collected before 1 May 2026. - [Office of the Privacy Commissioner (via LiveNews press-release distribution)](https://livenews.co.nz/2026/10/05/pbn-3886-2026-nzprivcmr3-opc-can-make-targeted-adverse-comments-in-response-to-privacy-matters/) — Privacy Act 2020 — The Privacy Act applies to actions taken by an overseas agency carrying on business in New Zealand, regardless of where the information is held or the individual is located. - [Office of the Privacy Commissioner (via LiveNews press-release distribution)](https://livenews.co.nz/2026/10/30/final-report-into-manage-my-health-inquiry-a-wake-up-call-for-agencies/) — Office of the Privacy Commissioner — OPC supervises the 13 Information Privacy Principles, receives mandatory breach notifications, and may issue binding codes of practice, access directions and compliance notices - [MLex](https://www.mlex.com/mlex/data-privacy-security/articles/2544354) — Privacy Amendment Act 2025 — Royal Assent 23 Sept 2025; technical amendments effective 24 Sept 2025; IPP 3A notification obligation effective 1 May 2026 - [Office of the Privacy Commissioner (via LiveNews press-release distribution)](https://livenews.co.nz/2026/10/05/pbn-3886-2026-nzprivcmr3-opc-can-make-targeted-adverse-comments-in-response-to-privacy-matters/) — Privacy Act 2020 — the Act explicitly applies to overseas-based entities carrying on business in New Zealand ### New Zealand: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core structural gaps versus GDPR analogues (no enumerated lawful bases, no statutory special categories, no anonymisation safe-harbour) justify amber despite functioning principle-based alternative. Primary framework Privacy Act 2020 (NZ) - Information Privacy Principles Supervisory authority [Office of the Privacy Commissioner (OPC)](https://www.privacy.org.nz/) Traffic-light rationale — Amber Core structural gaps versus GDPR analogues (no enumerated lawful bases, no statutory special categories, no anonymisation safe-harbour) justify amber despite functioning principle-based alternative. Periodic update · new data 2026-10-18 #### Lawful Processing & Special Data Two lawful-processing obligations reached or passed a compliance milestone this cycle. Information Privacy Principle 3A, which requires agencies that collect personal information indirectly to notify the individual concerned, subject to exceptions, came into force on 1 May 2026. This obligation is understood to have been introduced in part to help New Zealand retain its European Union adequacy status, linking a domestic lawful-processing change to an international data-flow consideration. Separately, the Biometric Processing Privacy Code, which came into force for new biometric processing on 3 November 2025, saw its transition grace period for historical processing activities end on 3 August 2026. From that date, all biometric processing, including activity that predates the Code, must comply with its requirements rather than benefiting from the grace-period carve-out. Together these two developments tighten New Zealand's lawful-processing regime on two fronts: a new notice obligation for indirect collection, and the closing of a transition window for biometric processing specifically, bringing historical biometric activity within the same compliance perimeter as new processing. #### Outlook The exceptions to the IPP3A notice obligation, and how broadly or narrowly the OPC interprets them in practice, are the detail most likely to shape how significant this obligation proves for agencies engaged in indirect data collection. D2 · Lawful Processing — Full Module Record 4 sub-modules · 74 words · 10 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### New Zealand: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Access/correction/response-window mechanics are robust and enforceable, but erasure, restriction/objection, and portability rights are largely absent, warranting amber overall. Primary framework Privacy Act 2020 (NZ) - IPP 6, IPP 7 Supervisory authority [Office of the Privacy Commissioner (OPC)](https://www.privacy.org.nz/) Traffic-light rationale — Amber Access/correction/response-window mechanics are robust and enforceable, but erasure, restriction/objection, and portability rights are largely absent, warranting amber overall. #### Sub-modules (5) #### Access RightGreen IPP6 grants individuals a right to confirm and access personal information held about them; OPC can issue binding access determinations where an agency refuses release. Claims (1): - Under the Act, if an agency refuses to make personal information available upon request, the OPC has the power to demand the release of this information through a binding access determination. #### Rectification And ErasureAmber IPP7 provides a correction right; there is no general statutory right to erasure/deletion, and OPC's children's privacy consultation records calls for a 'right to be forgotten' for children not yet enacted. Claims (1): - The Privacy Act does not currently provide any specific right to delete personal information, and many submitters to the OPC's children's privacy consultation argued in favor of a 'right to be forgotten' for children. #### Restriction And ObjectionRed No GDPR Art 18/21-style formal restriction or objection right was located; use/disclosure limits (IPP10/IPP11) provide indirect, narrower protection. #### Data PortabilityRed No data portability right equivalent to GDPR Art 20 was identified. #### Deadlines And Response WindowsGreen Access requests must generally be responded to within 20 working days under s41, with extensions permissible where reasonable; the Human Rights Review Tribunal has reviewed the reasonableness of such extensions. Claims (1): - The Human Rights Review Tribunal considered whether an agency's extension of the 20-working-day timeframe for responding to an information request under s41 of the Act had been made reasonably. Individuals have an access right (IPP6) and correction right (IPP7), with a statutory 20-working-day response window (extendable on reasonable grounds) enforceable via OPC binding access determinations/enforceable access directions. The Act does not provide a standalone right to erasure ('right to be forgotten'), restriction, objection, or portability comparable to GDPR Arts 16-21, a gap the OPC's own children's-privacy consultation has flagged for possible reform. No periodic updates recorded in this cycle Sources and claims (3) - [DataGuidance](https://www.dataguidance.com/opinion/new-zealand-new-privacy-act-step-towards-gold-standard-data-protection) — Under the Act, if an agency refuses to make personal information available upon request, the OPC has the power to demand the release of this information through a binding access determination. - [IAPP](https://iapp.org/news/a/notes-from-the-asia-pacific-region-a-look-at-new-zealands-opc-childrens-privacy-report) — The Privacy Act does not currently provide any specific right to delete personal information, and many submitters to the OPC's children's privacy consultation argued in favor of a 'right to be forgotten' for children. - [DataGuidance](https://www.dataguidance.com/news/new-zealand-tribunal-issues-judgment-real-estate-agents) — The Human Rights Review Tribunal considered whether an agency's extension of the 20-working-day timeframe for responding to an information request under s41 of the Act had been made reasonably. ### New Zealand: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Breach notification and security-of-processing duties are in force and actively enforced, but DPIA, ROPA, and processor-liability gaps (flagged by the regulator itself following the 2025/2026 MMH breach) justify amber rather than green. Primary framework Privacy Act 2020 (NZ), Part 6; Privacy Regulations 2020 Supervisory authority [Office of the Privacy Commissioner (OPC)](https://www.privacy.org.nz/) Traffic-light rationale — Amber Breach notification and security-of-processing duties are in force and actively enforced, but DPIA, ROPA, and processor-liability gaps (flagged by the regulator itself following the 2025/2026 MMH breach) justify amber rather than green. Periodic update · new data 2026-11-04 #### Controller/Processor Duties The Office of the Privacy Commissioner's final Phase 2 report into the Manage My Health inquiry, released 30 October 2026, confirms the Phase 1 finding that both Manage My Health Ltd and Health NZ breached Rule 5 of the Health Information Privacy Code by failing to maintain reasonable security safeguards. Compliance notices have been issued to both agencies, ordering remedial steps rather than imposing a financial penalty, since the Commissioner does not hold a GDPR-equivalent direct administrative fining power and relies on the compliance notice as its principal tool against an agency short of litigation. This structural limitation has stood since the compliance-notice power's introduction and was not altered this period. The Commissioner's earlier Phase 1 report went further than confirming the breach: it recommended amending the Privacy Act 2020 to create direct liability for third-party service providers and processors where reasonable security safeguards are not maintained. As matters stand, New Zealand's framework runs liability through an agency-and-agent model under section 11, under which a processor's failures are generally attributed back to the contracting agency rather than pursued against the processor directly. The proposed amendment would shift that structure toward direct processor accountability, but it remains a recommendation, not a Bill, and no legislative step toward introducing it has been identified. #### Outlook Whether the direct-processor-liability recommendation advances to a Bill, and at what stage, is the open question carried forward from this period's findings. Until legislative movement occurs, the agency-and-agent model under section 11 continues to govern how processor failures translate into agency liability, and the compliance notice remains the Commissioner's principal lever where an agency's security safeguards fall short. Periodic update · new data 2026-10-18 #### Controller/Processor Duties The Office of the Privacy Commissioner's Phase 1 inquiry, with findings released 27 May 2026, found that both Manage My Health Limited and Health New Zealand breached Rule 5 of the Health Information Privacy Code by failing to maintain reasonable security safeguards. The breach, a December 2025 cyber incident, affected 99,416 patients, 91 percent of them located in Northland. The Commissioner intends to issue compliance notices against both parties under section 123 of the Privacy Act 2020. The inquiry's most structurally significant finding is not the breach itself but what it exposed about New Zealand's controller-processor liability architecture: the Commissioner has recommended that agencies carry direct liability for their own security settings under the Privacy Act, including when providing services to others, because current law provides no equivalent to the direct processor obligations found under frameworks such as the GDPR. This recommendation, if legislated, would close a gap between New Zealand's principle-based controller duties and jurisdictions with explicit processor-level obligations. As at 18 October 2026, the recommendation remained a call on government to act, not a change in force, and whether it will be taken up has not been resolved. #### Outlook Whether government responds to the Commissioner's direct-processor-liability recommendation, and how the compliance notices against Manage My Health and Health New Zealand are ultimately resolved, are the two developments most likely to determine whether this cycle's findings produce lasting structural change to New Zealand's controller-processor duties. Periodic update · new data 2026-10-12 #### Controller/Processor Duties Two decisions this cycle sharpen New Zealand's application of the notifiable-breach test under the Privacy Act 2020. In decision note PBN4406, the Office of the Privacy Commissioner found that a legal practice had failed to recognise that forensic findings from May 2025, concerning an email-account compromise first notified to the Commissioner in November 2025, also themselves identified a separate notifiable privacy breach requiring its own assessment. The decision illustrates a recurring difficulty under the Act: an agency can comply with the notification obligation for the incident it recognises while still missing a second, related notifiable breach embedded within the same set of forensic findings, and the Commissioner's finding here treats that omission as a compliance failure in its own right. Separately, phase-one findings dated 27 May 2026 in the Manage My Health and Health New Zealand inquiry found that both parties had breached Rule 5, the security-safeguards rule, of the Health Information Privacy Code. Alongside those findings, the Commissioner is understood to have proposed amending the Privacy Act 2020 so that third-party service providers would be directly liable for failing to implement reasonable security safeguards, a change that would depart from the current structure under which liability for a processor's security failures sits primarily with the contracting agency. No bill implementing this proposal has yet been introduced, so the reform remains at the recommendation stage with no confirmed legislative timetable. Read together, these two developments point toward a widening application of existing obligations, breach-recognition completeness and security-safeguard compliance, rather than a change in the underlying legal test. The Act's notification obligation itself is unchanged: an agency must notify the Commissioner and affected individuals as soon as practicable after becoming aware of a notifiable privacy breach, meaning one reasonably believed to have caused, or be likely to cause, serious harm, and an unjustified failure to notify the Commissioner remains an offence carrying a maximum fine of NZ$10,000. What has moved is the Commissioner's apparent appetite to scrutinise both the thoroughness of breach recognition and the adequacy of processor-level security safeguards, and, in the Manage My Health and Health New Zealand matter, to recommend extending direct statutory liability to processors themselves. #### Outlook Whether the processor direct-liability proposal progresses to a bill is uncertain, and no date has been confirmed for any such introduction. In the interim, agencies relying on third-party service providers for health or other sensitive data processing should expect continued scrutiny of security-safeguard adequacy under existing Health Information Privacy Code and Privacy Act obligations, and should expect the Commissioner to continue testing whether breach assessments are complete rather than merely timely. Periodic update · new data 2026-09-28 #### Controller/Processor Duties A notable breach-notification event surfaced this cycle. The Office of the Privacy Commissioner reported that Manage My Health notified it of a privacy breach, and the OPC advised that primary-care providers did not need to separately notify in connection with that breach. This event is an operation of the Privacy Act 2020's mandatory breach-notification regime, which introduced mandatory breach notification in New Zealand for the first time; prior to the 2020 Act, New Zealand agencies had no statutory duty to notify a regulator of a data breach. The OPC's guidance that primary-care providers did not need to separately notify indicates a degree of consolidation in how notification duties are being administered where a shared health-sector platform is the entity experiencing the breach, rather than each downstream provider being treated as independently obligated to notify for the same underlying incident. This is a controller/processor-duties-relevant clarification for organisations operating shared platforms serving multiple downstream entities, since it suggests notification responsibility can attach at the platform level rather than being duplicated across every organisation using that platform. No other controller or processor duty development, such as new data-retention rules or processor-contract requirements, was identified this cycle beyond this breach-notification event. #### Outlook The Manage My Health notification is a live illustration of the Privacy Act 2020's mandatory breach-notification regime in the health sector specifically, and how the Office of the Privacy Commissioner continues to administer notification responsibility across shared platforms and their downstream users will be the relevant thing to watch for controllers and processors operating similar multi-provider arrangements. D4 · Controller & Processor — Full Module Record 7 sub-modules · 111 words · 17 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### New Zealand: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Confirmed, currently-maintained EU adequacy plus an operative IPP12 transfer mechanism support green, tempered by gaps in TIA/localisation coverage. Primary framework Privacy Act 2020 (NZ) - IPP 12; EU Adequacy Decision 2013/65/EU Supervisory authority [Office of the Privacy Commissioner (OPC)](https://www.privacy.org.nz/) Traffic-light rationale — Green Confirmed, currently-maintained EU adequacy plus an operative IPP12 transfer mechanism support green, tempered by gaps in TIA/localisation coverage. Periodic update · new data 2026-09-21 #### Cross-Border & Adequacy IPP3A was introduced primarily to help New Zealand retain its EU adequacy status, aligning New Zealand's indirect-collection notice obligations with the EU's Article 14 GDPR standard and Australia's APP 5. This adequacy-preservation motivation is confirmed with high confidence, and it is a significant framing point: it demonstrates that New Zealand's ongoing privacy reform agenda continues to be shaped substantially by the practical need to maintain the cross-border data-flow arrangements that its EU adequacy status supports. Notably, this adequacy-motivated reform proceeded despite the Office of the Privacy Commissioner continuing to operate without GDPR-equivalent direct administrative fining powers, a materially more limited enforcement toolkit than EU-model data protection authorities possess. This juxtaposition, a substantive notice obligation newly aligned with EU standards, paired with an enforcement toolkit that remains structurally narrower than the EU model, is itself worth noting as a persistent feature of New Zealand's approach to maintaining adequacy: substantive alignment without full enforcement-power parity. #### Outlook Whether the European Commission or other EU institutions formally comment on or reference IPP3A in any adequacy-review context is the key cross-border watch item for the coming cycle. No such formal EU-side response was identified this cycle, and New Zealand's adequacy status itself was not reported as under active review. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 73 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### New Zealand: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong evidence for the health-sector code; other sectoral overlays (credit, telecoms, education, insurance, financial) are asserted by general NZ privacy-law knowledge but not independently confirmed this run, requiring escalation. Primary framework Privacy Act 2020 (NZ) - Codes of Practice regime Supervisory authority [Office of the Privacy Commissioner (OPC)](https://www.privacy.org.nz/) Traffic-light rationale — Amber Strong evidence for the health-sector code; other sectoral overlays (credit, telecoms, education, insurance, financial) are asserted by general NZ privacy-law knowledge but not independently confirmed this run, requiring escalation. Periodic update · new data 2026-11-04 #### Sectoral Watch Following the Office of the Privacy Commissioner's final Manage My Health Phase 2 report, Health NZ has committed to strengthening privacy and security settings across the wider health sector, while disputing that it has itself committed any new breach beyond the Rule 5 finding already confirmed. The health sector's handling of this inquiry, and the sector-wide commitments that follow from it, bear watching given the scale of personal health information at stake and the disproportionate impact on Northland and Māori patients that the Commissioner's findings identified. #### Outlook The pace and substance of Health NZ's sector-wide strengthening commitments, and whether they extend beyond the specific systems implicated in the Manage My Health inquiry, remain to be seen as the health sector responds to the Commissioner's findings. Periodic update · new data 2026-10-18 #### Sectoral Watch New Zealand's Consumer Data Right standards management for banking transferred from Payments NZ's API Centre to the Ministry of Business, Innovation and Employment on 30 September 2026. This sectoral development places data-sharing standards for open banking under direct ministry stewardship rather than industry self-administration, a governance change with implications for how banking-sector data-sharing obligations are set and enforced going forward. This transition is tracked in parallel by world-payments for its payments-market-access implications; from a data-protection perspective, the significance lies in the shift of data-sharing standards governance from an industry body to a ministry operating under statute, which may affect the regulatory channel through which future data-protection-adjacent standards for banking data are set. #### Outlook Whether MBIE's assumption of CDR standards stewardship leads to any change in the substantive data-sharing or consent standards themselves, as distinct from simply the governance body administering them, is the detail to watch for this sector. Periodic update · new data 2026-10-12 #### Sectoral Watch New Zealand's open-banking and consumer-data-right governance changed hands this cycle. The Ministry of Business, Innovation and Employment confirmed on 1 September 2026 that it will assume governance of consumer data right and open-banking API standards effective from the end of September 2026, the point at which Payments NZ's API Centre, which had held the relevant licensing agreement with MBIE, closed. This is a stewardship transition rather than a substantive change to the standards themselves, but it moves day-to-day governance of the technical API framework from an industry body operating under a ministry licence to the ministry directly. This handover sits alongside the continuing rollout of the Customer and Product Data Act 2025 regime. ANZ, ASB, BNZ and Westpac have been designated data holders under that Act since 1 December 2025, and Kiwibank is being phased in on a staggered basis, with payment-initiation obligations from 1 June 2026 and account-information obligations from 1 December 2026. The combination of the designated-data-holder rollout and the standards-stewardship handover means that, for the banking sector at least, two separate strands of open-banking governance, who must share data and who governs the technical rules for sharing it, are both in active motion in the same window. Whether MBIE's assumption of standards stewardship has produced a first substantive standards notice within the current period has not been confirmed, and this remains a gap rather than a stated negative finding. The practical significance of the handover for data holders and third parties relying on the API standards will depend on whether MBIE maintains continuity with the API Centre's existing technical specifications or signals its own revisions, neither of which is yet evident from the record. #### Outlook The near-term question is whether MBIE's stewardship produces visible continuity or early signals of change to the open-banking API standards now that the API Centre has closed. With Kiwibank's account-information obligations not due until 1 December 2026, the designated-data-holder rollout under the Customer and Product Data Act 2025 will continue running in parallel with the standards handover, and both bear watching for whether the change of governance body introduces any discontinuity for data holders or accredited third parties relying on the API framework. Periodic update · new data 2026-09-21 #### Sectoral Watch The notable sectoral development this cycle is health-sector specific: the Office of the Privacy Commissioner's finding that Manage My Health and Health NZ breached the Privacy Act through inadequate security safeguards following a cyber incident. This finding, reported at Probable confidence given reliance on a single lower-tier source, places the health sector at the centre of this cycle's controller/processor-duty enforcement attention, distinct from the framework-level IPP3A and biometric-code developments affecting agencies generally across sectors. The recommended response, compliance notices and centralised verification measures for health-sector vendors, if adopted, would represent a sector-specific structural intervention rather than a general Privacy Act amendment, targeting the health-vendor ecosystem specifically in response to the identified security-safeguards gap. #### Outlook Whether the centralised verification measures proposed for health-sector vendors are formally adopted, and how broadly they would apply across New Zealand's health-technology vendor ecosystem, is the key sectoral watch item for the coming cycle. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 92 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### New Zealand: D7 AdTech & Commercial Privacy 6 sub-modules Not assessed ▾ No adtech-specific commercial-privacy regime was substantiated in this pass; this is an explicit, evidenced gap rather than silent omission. Supervisory authority [Office of the Privacy Commissioner (OPC)](https://www.privacy.org.nz/) Traffic-light rationale — Not assessed No adtech-specific commercial-privacy regime was substantiated in this pass; this is an explicit, evidenced gap rather than silent omission. #### Sub-modules (6) #### Cookies And TrackersRed No dedicated cookie-consent statute was identified; general IPPs would apply to any personal information collected via trackers. #### Dark PatternsRed No NZ-specific dark-pattern prohibition was identified. #### Opt Out SignalsRed No recognised technical opt-out signal (e.g., Global Privacy Control) regime was identified for New Zealand. #### Clean Rooms And DcrRed No clean-room/data-collaboration-room specific rules were identified. #### Cross Context AdvertisingRed No CPRA-style 'sale'/'share' concept or cross-context advertising rule was identified. #### Direct MarketingAmber No dedicated direct-marketing consent/suppression regime was independently verified in this research pass beyond general IPP use/disclosure limits. No NZ-specific cookie/tracker consent regime, dark-pattern prohibition, recognised opt-out signal (e.g. GPC), clean-room framework, or CPRA-style 'sale/share' concept was identified; the general Privacy Act IPPs apply to any online collection of personal information but do not create adtech-specific rules. A dedicated direct-marketing/anti-spam statute may exist in New Zealand but was not verified in this research pass. ### New Zealand: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A dedicated, binding Biometric Processing Privacy Code is a significant, verified development, but ADM transparency, profiling restrictions, and genetic-data regimes remain unaddressed gaps acknowledged by the regulator itself. Primary framework Biometric Processing Privacy Code 2025; Privacy Act 2020 IPPs (applied to AI via OPC guidance) Supervisory authority [Office of the Privacy Commissioner (OPC)](https://www.privacy.org.nz/) Traffic-light rationale — Amber A dedicated, binding Biometric Processing Privacy Code is a significant, verified development, but ADM transparency, profiling restrictions, and genetic-data regimes remain unaddressed gaps acknowledged by the regulator itself. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance The Biometric Processing Privacy Code's transition grace period for historical biometric-processing activities ended on 3 August 2026. The Code itself came into force for new biometric processing on 3 November 2025, but agencies with pre-existing biometric-processing activities were given a transition window to come into compliance; that window has now closed, meaning all biometric processing, including activity predating the Code, must comply with its requirements going forward. Separately, the Commissioner set public expectations for smart-glasses deployments on 28 August 2026, addressing the surveillance and biometric-adjacent privacy considerations raised by wearable recording devices becoming more widely available. This statement extends the Commissioner's guidance function into an emerging technology area not yet addressed by dedicated statute. #### Outlook How agencies that were operating under the now-expired transition grace period adapt their historical biometric-processing activities to full Code compliance is the practical compliance question this development raises; any OPC enforcement activity targeting non-compliant historical processing would be a significant escalation signal to watch for. Periodic update · new data 2026-10-05 #### Algorithmic, Biometric & Surveillance Governance The Biometric Processing Privacy Code 2025 governs biometric processing in New Zealand as a sector-specific code issued under the Privacy Act 2020, administered by the Office of the Privacy Commissioner. The Code took force on 3 November 2025 with thirteen replacement rules governing biometric information handling. Organisations that were already operating biometric systems before that date were given a transitional period and were required to achieve compliance with the Code's rules by 3 August 2026. That transitional deadline has now passed, meaning the Code's full rule set now applies to all covered biometric processing in New Zealand, including deployments that predate the Code itself. No newer algorithmic or AI-specific governance reform beyond the biometric regime was identified for this jurisdiction this period; the grace-period closure is the most recent substantive development in this module, though it falls at the edge of the current reporting window. #### Outlook With the transitional compliance deadline closed, the Office of the Privacy Commissioner's approach to supervising ongoing compliance with the Code's thirteen rules, particularly for organisations that relied on the transitional period, is the development to watch. Any supervisory action would be constrained by the Commissioner's existing enforcement toolkit, which does not include GDPR-style direct administrative fining powers. Periodic update · new data 2026-09-28 #### Algorithmic, Biometric & Surveillance Governance New Zealand's biometric-governance framework moved from a transitional to a settled compliance posture this cycle. The Biometrics Processing Privacy Code, which came into force in November 2025, governs purpose, sourcing, collection, storage, accessibility, retention, disclosure and use limitations for biometric information, providing New Zealand with a dedicated regulatory instrument for biometric processing specifically, distinct from the general provisions of the Privacy Act 2020. The Code included a grace period allowing agencies with historical biometric-processing arrangements, meaning arrangements already in place before the Code's November 2025 commencement, time to bring those arrangements into line with the Code's requirements. That grace period expired on 3 August 2026. From that date forward, historical biometric processing is subject to the same compliance expectations as biometric processing that began after the Code took effect, closing what had been a transitional tolerance window. No algorithmic-governance or automated-decision-making-specific development, as distinct from the biometric-processing Code, was identified this cycle; the material signal in this module this cycle is concentrated entirely in the biometric-processing grace-period expiry. #### Outlook With the grace period now expired, the Office of the Privacy Commissioner's practical enforcement posture toward agencies with legacy biometric-processing arrangements that have not yet achieved Code compliance is the key development to watch. Whether the Commissioner pursues active compliance-checking of historical arrangements, or relies on complaint-driven enforcement, will determine how quickly the Code's requirements are realised in practice across affected sectors. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 117 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### New Zealand: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ Absence of parental consent mechanisms, profiling bans, and dependent-adult protections, combined with the regulator's own acknowledgement that reform is still under consideration, supports a red rating for this module. Primary framework Privacy Act 2020 (NZ) - s49(1)(c) Supervisory authority [Office of the Privacy Commissioner (OPC)](https://www.privacy.org.nz/) Traffic-light rationale — Red Absence of parental consent mechanisms, profiling bans, and dependent-adult protections, combined with the regulator's own acknowledgement that reform is still under consideration, supports a red rating for this module. D9 · Children's Privacy — Full Module Record 5 sub-modules · 103 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### New Zealand: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Active, escalating enforcement and a functioning (if narrow) redress pathway exist, but the acknowledged absence of a civil-penalties regime for principal IPP breaches is a material, regulator-acknowledged weakness. Primary framework Privacy Act 2020 (NZ) - Parts 5-8 Supervisory authority [Office of the Privacy Commissioner (OPC)](https://www.privacy.org.nz/) Traffic-light rationale — Amber Active, escalating enforcement and a functioning (if narrow) redress pathway exist, but the acknowledged absence of a civil-penalties regime for principal IPP breaches is a material, regulator-acknowledged weakness. Periodic update · new data 2026-11-04 #### Enforcement & Redress Two developments define this period's enforcement picture. First, the Office of the Privacy Commissioner's final Manage My Health Phase 2 report, released 30 October 2026, confirms Rule 5 breaches of the Health Information Privacy Code by both Manage My Health Ltd and Health NZ, with compliance notices issued to both agencies ordering remedial action. The Commissioner's findings noted a disproportionate impact on Northland and Māori patients from the security failures identified. Because the Commissioner lacks a direct administrative fining power equivalent to that available to GDPR regulators, the compliance notice functions as its most consequential enforcement instrument short of litigation in this matter. Second, in a decision note dated 5 October 2026 (PBN/3886 [2026] NZPrivCmr3), the Commissioner found that a New Zealand-operating organisation with an overseas parent had structured its privacy policies around overseas privacy law without reference to the Privacy Act 2020. The Commissioner stated plainly that organisations operating in New Zealand must use privacy policies and practices grounded in New Zealand law, a position with direct relevance for any overseas-parented group operating locally through a subsidiary or branch without having localised its privacy documentation. #### Outlook The Commissioner's concurrent pursuit of direct processor liability reform, confirmation of the Manage My Health breaches, and the PBN/3886 decision note together read as a deliberate push for enhanced statutory enforcement tools rather than isolated incidents. Organisations with overseas-rooted privacy frameworks operating in New Zealand should expect continued scrutiny of whether their policies and practices are genuinely grounded in the Privacy Act 2020, and the health sector should expect continued attention to the remedial steps ordered against Manage My Health Ltd and Health NZ. Periodic update · new data 2026-10-18 #### Enforcement & Redress New Zealand's privacy enforcement toolkit remains structurally limited. The Office of the Privacy Commissioner may issue compliance notices under sections 121 to 126 of the Privacy Act 2020; failure to comply with a compliance notice without reasonable excuse is a criminal offence under section 127, carrying a fine of up to NZD 10,000. No separate civil administrative-penalty power exists. This limited toolkit was tested directly this cycle by the Manage My Health and Health New Zealand breach findings, where the Commissioner is reported to have issued compliance notices in October 2026 following the Phase 1 inquiry's findings of Rule 5 security-safeguard breaches affecting 99,416 patients. The Commissioner publicly called, on 3 June 2026, for civil-penalty powers following the Manage My Health and Health New Zealand findings, explicitly linking the case to the broader enforcement-architecture gap. As at 18 October 2026, whether this call has produced any government or Cabinet response had not been resolved. #### Outlook The application of the October 2026 compliance notices against Manage My Health and Health New Zealand, and any government response to the Commissioner's 3 June 2026 call for civil-penalty powers, are the two enforcement-architecture developments most likely to shape New Zealand's redress regime going forward. Periodic update · new data 2026-10-12 #### Enforcement & Redress New Zealand's enforcement picture this cycle combines a volume signal, a procedural decision, and restated guidance, against a statutory penalty framework that remains narrow. The Office of the Privacy Commissioner's 2024-25 Annual Report is understood to have recorded a 43% increase in the number of serious privacy breaches notified to the regulator, a substantial rise in reported volume. That increase sits against a penalty structure under the Privacy Act 2020 whose only direct financial penalty is a maximum NZ$10,000 fine for an unjustified failure to notify a notifiable breach; New Zealand has no broader civil-penalty regime of the kind operating in Australia, and the Commissioner's enforcement toolkit beyond that notification offence consists principally of binding compliance notices, access directions and codes of practice rather than administrative fines tied to the severity or scale of a breach itself. Procedurally, decision note PBN4406 shows the Commissioner applying the notifiable-breach test closely, finding that a legal practice's November 2025 notification of an email-account compromise did not capture a separate notifiable breach that had already been identified in forensic findings from May 2025. This kind of decision functions as redress-relevant guidance for the wider regulated community even where it does not itself impose a financial penalty, since the only statutory fine available attaches to a failure to notify, not to the underlying breach. The Commissioner also published guidance on delayed privacy breach notification, reported around 29 September 2026, restating that organisations should develop incident response plans and notify within 72 hours of recognising a notifiable breach. This restates an existing non-binding expectation rather than introducing a new timeline; the statutory standard remains notification as soon as practicable, with the 72-hour figure operating as the Commissioner's own guidance rather than a fixed legal deadline. #### Outlook The rising volume of notified serious breaches, reported at 43% year on year, sits uneasily against a penalty regime capped at a NZ$10,000 notification offence, and this gap between enforcement pressure and the statutory toolkit is likely to remain a point of commentary. Whether the processor-liability proposal arising separately from the Manage My Health and Health New Zealand inquiry, or any broader civil-penalty reform, is taken up by Parliament remains unconfirmed and should be read as an open question rather than a scheduled development. Periodic update · new data 2026-09-28 #### Enforcement & Redress A structural limitation in New Zealand's enforcement toolkit remains material this cycle: the Office of the Privacy Commissioner does not have GDPR-equivalent direct administrative fining powers, despite New Zealand holding an EU adequacy decision. This gap between New Zealand's adequacy status, which is typically associated with GDPR-comparable protections, and its enforcement toolkit, which lacks the direct fining mechanism that underpins GDPR enforcement in the EU, is a standing feature of the regime rather than a new development, but it carries particular salience this cycle given the adequacy-retention rationale attached to the IPP 3A amendment discussed elsewhere in this brief. Where the OPC's own toolkit does have teeth, it operates through investigative and enforcement powers including the issuing of compliance notices, rather than through direct monetary penalties. Separately, individuals are not left solely dependent on OPC action: they may bring privacy claims before the Human Rights Review Tribunal, which can award damages. This private right of action functions as an independent redress channel that operates regardless of whether the OPC itself pursues an enforcement notice against the same conduct. The Manage My Health breach notification, discussed under Controller/Processor Duties, is the notable enforcement-adjacent event this cycle, illustrating the mandatory breach-notification regime in active operation, though it did not itself generate a public enforcement action or Tribunal claim within the evidence reviewed this cycle. #### Outlook Whether New Zealand's enforcement architecture evolves toward direct administrative fining powers, closer to the GDPR model, or continues to rely on compliance notices and Tribunal-based private redress, remains an open structural question, and one made more salient by the jurisdiction's adequacy status. The Human Rights Review Tribunal's caseload and damages awards are the practical indicator to watch for how meaningful the private right of action proves in redressing individual harm. Periodic update · new data 2026-09-21 #### Enforcement & Redress The Office of the Privacy Commissioner continues to operate without GDPR-equivalent direct administrative fining powers, a materially more limited enforcement toolkit than EU-model data protection authorities. Reports suggest this structural limitation persists despite New Zealand's EU adequacy status and despite this cycle's IPP3A reform substantively aligning notice obligations with EU standards; this is a standing caution flag rather than a new development, carried forward at Probable-consistent, hedged confidence given reliance on a lower-tier source. Against this backdrop, the Office's finding against Manage My Health and Health NZ, recommending compliance notices and centralised verification measures following a cyber incident, represents active use of the Commissioner's available (non-fining) enforcement tools. Separately, the New Zealand Government's announcement of a new Cyber Security Strategy 2026-2030 and accompanying Action Plan 2026-2027 signals a renewed cross-government push to strengthen resilience to digital threats; this is reported at Probable confidence and represents a forward-looking policy signal rather than a confirmed enforcement-posture change within this monitor's specific remit this cycle. #### Outlook Whether the Office of the Privacy Commissioner has taken any enforcement action specifically citing IPP3A since its 1 May 2026 commencement remains unestablished; no case notes were retrieved this cycle. How the new Cyber Security Strategy interacts with the Commissioner's own enforcement priorities, particularly regarding health-sector security failures of the kind identified against Manage My Health and Health NZ, is the key watch item for the coming cycle. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 182 words · 19 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) data localisation Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties