New Zealand Data Protection & Privacy Regulation

Lawful Processing & Special Data

Two lawful-processing obligations reached or passed a compliance milestone this cycle. Information Privacy Principle 3A, which requires agencies that collect personal information indirectly to notify the individual concerned, subject to exceptions, came into force on 1 May 2026. This obligation is understood to have been introduced in part to help New Zealand retain its European Union adequacy status, linking a domestic lawful-processing change to an international data-flow consideration. Separately, the Biometric Processing Privacy Code, which came into force for new biometric processing on 3 November 2025, saw its transition grace period for historical processing activities end on 3 August 2026. From that date, all biometric processing, including activity that predates the Code, must comply with its requirements rather than benefiting from the grace-period carve-out.

Together these two developments tighten New Zealand's lawful-processing regime on two fronts: a new notice obligation for indirect collection, and the closing of a transition window for biometric processing specifically, bringing historical biometric activity within the same compliance perimeter as new processing.

Outlook

The exceptions to the IPP3A notice obligation, and how broadly or narrowly the OPC interprets them in practice, are the detail most likely to shape how significant this obligation proves for agencies engaged in indirect data collection.

Controller/Processor Duties

The Office of the Privacy Commissioner's final Phase 2 report into the Manage My Health inquiry, released 30 October 2026, confirms the Phase 1 finding that both Manage My Health Ltd and Health NZ breached Rule 5 of the Health Information Privacy Code by failing to maintain reasonable security safeguards. Compliance notices have been issued to both agencies, ordering remedial steps rather than imposing a financial penalty, since the Commissioner does not hold a GDPR-equivalent direct administrative fining power and relies on the compliance notice as its principal tool against an agency short of litigation. This structural limitation has stood since the compliance-notice power's introduction and was not altered this period.

The Commissioner's earlier Phase 1 report went further than confirming the breach: it recommended amending the Privacy Act 2020 to create direct liability for third-party service providers and processors where reasonable security safeguards are not maintained. As matters stand, New Zealand's framework runs liability through an agency-and-agent model under section 11, under which a processor's failures are generally attributed back to the contracting agency rather than pursued against the processor directly. The proposed amendment would shift that structure toward direct processor accountability, but it remains a recommendation, not a Bill, and no legislative step toward introducing it has been identified.

Outlook

Whether the direct-processor-liability recommendation advances to a Bill, and at what stage, is the open question carried forward from this period's findings. Until legislative movement occurs, the agency-and-agent model under section 11 continues to govern how processor failures translate into agency liability, and the compliance notice remains the Commissioner's principal lever where an agency's security safeguards fall short.

Controller/Processor Duties

The Office of the Privacy Commissioner's Phase 1 inquiry, with findings released 27 May 2026, found that both Manage My Health Limited and Health New Zealand breached Rule 5 of the Health Information Privacy Code by failing to maintain reasonable security safeguards. The breach, a December 2025 cyber incident, affected 99,416 patients, 91 percent of them located in Northland. The Commissioner intends to issue compliance notices against both parties under section 123 of the Privacy Act 2020.

The inquiry's most structurally significant finding is not the breach itself but what it exposed about New Zealand's controller-processor liability architecture: the Commissioner has recommended that agencies carry direct liability for their own security settings under the Privacy Act, including when providing services to others, because current law provides no equivalent to the direct processor obligations found under frameworks such as the GDPR. This recommendation, if legislated, would close a gap between New Zealand's principle-based controller duties and jurisdictions with explicit processor-level obligations. As at 18 October 2026, the recommendation remained a call on government to act, not a change in force, and whether it will be taken up has not been resolved.

Outlook

Whether government responds to the Commissioner's direct-processor-liability recommendation, and how the compliance notices against Manage My Health and Health New Zealand are ultimately resolved, are the two developments most likely to determine whether this cycle's findings produce lasting structural change to New Zealand's controller-processor duties.

Controller/Processor Duties

Two decisions this cycle sharpen New Zealand's application of the notifiable-breach test under the Privacy Act 2020. In decision note PBN4406, the Office of the Privacy Commissioner found that a legal practice had failed to recognise that forensic findings from May 2025, concerning an email-account compromise first notified to the Commissioner in November 2025, also themselves identified a separate notifiable privacy breach requiring its own assessment. The decision illustrates a recurring difficulty under the Act: an agency can comply with the notification obligation for the incident it recognises while still missing a second, related notifiable breach embedded within the same set of forensic findings, and the Commissioner's finding here treats that omission as a compliance failure in its own right.

Separately, phase-one findings dated 27 May 2026 in the Manage My Health and Health New Zealand inquiry found that both parties had breached Rule 5, the security-safeguards rule, of the Health Information Privacy Code. Alongside those findings, the Commissioner is understood to have proposed amending the Privacy Act 2020 so that third-party service providers would be directly liable for failing to implement reasonable security safeguards, a change that would depart from the current structure under which liability for a processor's security failures sits primarily with the contracting agency. No bill implementing this proposal has yet been introduced, so the reform remains at the recommendation stage with no confirmed legislative timetable.

Read together, these two developments point toward a widening application of existing obligations, breach-recognition completeness and security-safeguard compliance, rather than a change in the underlying legal test. The Act's notification obligation itself is unchanged: an agency must notify the Commissioner and affected individuals as soon as practicable after becoming aware of a notifiable privacy breach, meaning one reasonably believed to have caused, or be likely to cause, serious harm, and an unjustified failure to notify the Commissioner remains an offence carrying a maximum fine of NZ$10,000. What has moved is the Commissioner's apparent appetite to scrutinise both the thoroughness of breach recognition and the adequacy of processor-level security safeguards, and, in the Manage My Health and Health New Zealand matter, to recommend extending direct statutory liability to processors themselves.

Outlook

Whether the processor direct-liability proposal progresses to a bill is uncertain, and no date has been confirmed for any such introduction. In the interim, agencies relying on third-party service providers for health or other sensitive data processing should expect continued scrutiny of security-safeguard adequacy under existing Health Information Privacy Code and Privacy Act obligations, and should expect the Commissioner to continue testing whether breach assessments are complete rather than merely timely.

Controller/Processor Duties

A notable breach-notification event surfaced this cycle. The Office of the Privacy Commissioner reported that Manage My Health notified it of a privacy breach, and the OPC advised that primary-care providers did not need to separately notify in connection with that breach. This event is an operation of the Privacy Act 2020's mandatory breach-notification regime, which introduced mandatory breach notification in New Zealand for the first time; prior to the 2020 Act, New Zealand agencies had no statutory duty to notify a regulator of a data breach.

The OPC's guidance that primary-care providers did not need to separately notify indicates a degree of consolidation in how notification duties are being administered where a shared health-sector platform is the entity experiencing the breach, rather than each downstream provider being treated as independently obligated to notify for the same underlying incident. This is a controller/processor-duties-relevant clarification for organisations operating shared platforms serving multiple downstream entities, since it suggests notification responsibility can attach at the platform level rather than being duplicated across every organisation using that platform.

No other controller or processor duty development, such as new data-retention rules or processor-contract requirements, was identified this cycle beyond this breach-notification event.

Outlook

The Manage My Health notification is a live illustration of the Privacy Act 2020's mandatory breach-notification regime in the health sector specifically, and how the Office of the Privacy Commissioner continues to administer notification responsibility across shared platforms and their downstream users will be the relevant thing to watch for controllers and processors operating similar multi-provider arrangements.

Cross-Border & Adequacy

IPP3A was introduced primarily to help New Zealand retain its EU adequacy status, aligning New Zealand's indirect-collection notice obligations with the EU's Article 14 GDPR standard and Australia's APP 5. This adequacy-preservation motivation is confirmed with high confidence, and it is a significant framing point: it demonstrates that New Zealand's ongoing privacy reform agenda continues to be shaped substantially by the practical need to maintain the cross-border data-flow arrangements that its EU adequacy status supports.

Notably, this adequacy-motivated reform proceeded despite the Office of the Privacy Commissioner continuing to operate without GDPR-equivalent direct administrative fining powers, a materially more limited enforcement toolkit than EU-model data protection authorities possess. This juxtaposition, a substantive notice obligation newly aligned with EU standards, paired with an enforcement toolkit that remains structurally narrower than the EU model, is itself worth noting as a persistent feature of New Zealand's approach to maintaining adequacy: substantive alignment without full enforcement-power parity.

Outlook

Whether the European Commission or other EU institutions formally comment on or reference IPP3A in any adequacy-review context is the key cross-border watch item for the coming cycle. No such formal EU-side response was identified this cycle, and New Zealand's adequacy status itself was not reported as under active review.

Sectoral Watch

Following the Office of the Privacy Commissioner's final Manage My Health Phase 2 report, Health NZ has committed to strengthening privacy and security settings across the wider health sector, while disputing that it has itself committed any new breach beyond the Rule 5 finding already confirmed. The health sector's handling of this inquiry, and the sector-wide commitments that follow from it, bear watching given the scale of personal health information at stake and the disproportionate impact on Northland and Māori patients that the Commissioner's findings identified.

Outlook

The pace and substance of Health NZ's sector-wide strengthening commitments, and whether they extend beyond the specific systems implicated in the Manage My Health inquiry, remain to be seen as the health sector responds to the Commissioner's findings.

Sectoral Watch

New Zealand's Consumer Data Right standards management for banking transferred from Payments NZ's API Centre to the Ministry of Business, Innovation and Employment on 30 September 2026. This sectoral development places data-sharing standards for open banking under direct ministry stewardship rather than industry self-administration, a governance change with implications for how banking-sector data-sharing obligations are set and enforced going forward.

This transition is tracked in parallel by world-payments for its payments-market-access implications; from a data-protection perspective, the significance lies in the shift of data-sharing standards governance from an industry body to a ministry operating under statute, which may affect the regulatory channel through which future data-protection-adjacent standards for banking data are set.

Outlook

Whether MBIE's assumption of CDR standards stewardship leads to any change in the substantive data-sharing or consent standards themselves, as distinct from simply the governance body administering them, is the detail to watch for this sector.

Sectoral Watch

New Zealand's open-banking and consumer-data-right governance changed hands this cycle. The Ministry of Business, Innovation and Employment confirmed on 1 September 2026 that it will assume governance of consumer data right and open-banking API standards effective from the end of September 2026, the point at which Payments NZ's API Centre, which had held the relevant licensing agreement with MBIE, closed. This is a stewardship transition rather than a substantive change to the standards themselves, but it moves day-to-day governance of the technical API framework from an industry body operating under a ministry licence to the ministry directly.

This handover sits alongside the continuing rollout of the Customer and Product Data Act 2025 regime. ANZ, ASB, BNZ and Westpac have been designated data holders under that Act since 1 December 2025, and Kiwibank is being phased in on a staggered basis, with payment-initiation obligations from 1 June 2026 and account-information obligations from 1 December 2026. The combination of the designated-data-holder rollout and the standards-stewardship handover means that, for the banking sector at least, two separate strands of open-banking governance, who must share data and who governs the technical rules for sharing it, are both in active motion in the same window.

Whether MBIE's assumption of standards stewardship has produced a first substantive standards notice within the current period has not been confirmed, and this remains a gap rather than a stated negative finding. The practical significance of the handover for data holders and third parties relying on the API standards will depend on whether MBIE maintains continuity with the API Centre's existing technical specifications or signals its own revisions, neither of which is yet evident from the record.

Outlook

The near-term question is whether MBIE's stewardship produces visible continuity or early signals of change to the open-banking API standards now that the API Centre has closed. With Kiwibank's account-information obligations not due until 1 December 2026, the designated-data-holder rollout under the Customer and Product Data Act 2025 will continue running in parallel with the standards handover, and both bear watching for whether the change of governance body introduces any discontinuity for data holders or accredited third parties relying on the API framework.

Sectoral Watch

The notable sectoral development this cycle is health-sector specific: the Office of the Privacy Commissioner's finding that Manage My Health and Health NZ breached the Privacy Act through inadequate security safeguards following a cyber incident. This finding, reported at Probable confidence given reliance on a single lower-tier source, places the health sector at the centre of this cycle's controller/processor-duty enforcement attention, distinct from the framework-level IPP3A and biometric-code developments affecting agencies generally across sectors.

The recommended response, compliance notices and centralised verification measures for health-sector vendors, if adopted, would represent a sector-specific structural intervention rather than a general Privacy Act amendment, targeting the health-vendor ecosystem specifically in response to the identified security-safeguards gap.

Outlook

Whether the centralised verification measures proposed for health-sector vendors are formally adopted, and how broadly they would apply across New Zealand's health-technology vendor ecosystem, is the key sectoral watch item for the coming cycle.

Algorithmic, Biometric & Surveillance Governance

The Biometric Processing Privacy Code's transition grace period for historical biometric-processing activities ended on 3 August 2026. The Code itself came into force for new biometric processing on 3 November 2025, but agencies with pre-existing biometric-processing activities were given a transition window to come into compliance; that window has now closed, meaning all biometric processing, including activity predating the Code, must comply with its requirements going forward.

Separately, the Commissioner set public expectations for smart-glasses deployments on 28 August 2026, addressing the surveillance and biometric-adjacent privacy considerations raised by wearable recording devices becoming more widely available. This statement extends the Commissioner's guidance function into an emerging technology area not yet addressed by dedicated statute.

Outlook

How agencies that were operating under the now-expired transition grace period adapt their historical biometric-processing activities to full Code compliance is the practical compliance question this development raises; any OPC enforcement activity targeting non-compliant historical processing would be a significant escalation signal to watch for.

Algorithmic, Biometric & Surveillance Governance

The Biometric Processing Privacy Code 2025 governs biometric processing in New Zealand as a sector-specific code issued under the Privacy Act 2020, administered by the Office of the Privacy Commissioner. The Code took force on 3 November 2025 with thirteen replacement rules governing biometric information handling. Organisations that were already operating biometric systems before that date were given a transitional period and were required to achieve compliance with the Code's rules by 3 August 2026. That transitional deadline has now passed, meaning the Code's full rule set now applies to all covered biometric processing in New Zealand, including deployments that predate the Code itself. No newer algorithmic or AI-specific governance reform beyond the biometric regime was identified for this jurisdiction this period; the grace-period closure is the most recent substantive development in this module, though it falls at the edge of the current reporting window.

Outlook

With the transitional compliance deadline closed, the Office of the Privacy Commissioner's approach to supervising ongoing compliance with the Code's thirteen rules, particularly for organisations that relied on the transitional period, is the development to watch. Any supervisory action would be constrained by the Commissioner's existing enforcement toolkit, which does not include GDPR-style direct administrative fining powers.

Algorithmic, Biometric & Surveillance Governance

New Zealand's biometric-governance framework moved from a transitional to a settled compliance posture this cycle. The Biometrics Processing Privacy Code, which came into force in November 2025, governs purpose, sourcing, collection, storage, accessibility, retention, disclosure and use limitations for biometric information, providing New Zealand with a dedicated regulatory instrument for biometric processing specifically, distinct from the general provisions of the Privacy Act 2020.

The Code included a grace period allowing agencies with historical biometric-processing arrangements, meaning arrangements already in place before the Code's November 2025 commencement, time to bring those arrangements into line with the Code's requirements. That grace period expired on 3 August 2026. From that date forward, historical biometric processing is subject to the same compliance expectations as biometric processing that began after the Code took effect, closing what had been a transitional tolerance window.

No algorithmic-governance or automated-decision-making-specific development, as distinct from the biometric-processing Code, was identified this cycle; the material signal in this module this cycle is concentrated entirely in the biometric-processing grace-period expiry.

Outlook

With the grace period now expired, the Office of the Privacy Commissioner's practical enforcement posture toward agencies with legacy biometric-processing arrangements that have not yet achieved Code compliance is the key development to watch. Whether the Commissioner pursues active compliance-checking of historical arrangements, or relies on complaint-driven enforcement, will determine how quickly the Code's requirements are realised in practice across affected sectors.

Enforcement & Redress

Two developments define this period's enforcement picture. First, the Office of the Privacy Commissioner's final Manage My Health Phase 2 report, released 30 October 2026, confirms Rule 5 breaches of the Health Information Privacy Code by both Manage My Health Ltd and Health NZ, with compliance notices issued to both agencies ordering remedial action. The Commissioner's findings noted a disproportionate impact on Northland and Māori patients from the security failures identified. Because the Commissioner lacks a direct administrative fining power equivalent to that available to GDPR regulators, the compliance notice functions as its most consequential enforcement instrument short of litigation in this matter.

Second, in a decision note dated 5 October 2026 (PBN/3886 [2026] NZPrivCmr3), the Commissioner found that a New Zealand-operating organisation with an overseas parent had structured its privacy policies around overseas privacy law without reference to the Privacy Act 2020. The Commissioner stated plainly that organisations operating in New Zealand must use privacy policies and practices grounded in New Zealand law, a position with direct relevance for any overseas-parented group operating locally through a subsidiary or branch without having localised its privacy documentation.

Outlook

The Commissioner's concurrent pursuit of direct processor liability reform, confirmation of the Manage My Health breaches, and the PBN/3886 decision note together read as a deliberate push for enhanced statutory enforcement tools rather than isolated incidents. Organisations with overseas-rooted privacy frameworks operating in New Zealand should expect continued scrutiny of whether their policies and practices are genuinely grounded in the Privacy Act 2020, and the health sector should expect continued attention to the remedial steps ordered against Manage My Health Ltd and Health NZ.

Enforcement & Redress

New Zealand's privacy enforcement toolkit remains structurally limited. The Office of the Privacy Commissioner may issue compliance notices under sections 121 to 126 of the Privacy Act 2020; failure to comply with a compliance notice without reasonable excuse is a criminal offence under section 127, carrying a fine of up to NZD 10,000. No separate civil administrative-penalty power exists. This limited toolkit was tested directly this cycle by the Manage My Health and Health New Zealand breach findings, where the Commissioner is reported to have issued compliance notices in October 2026 following the Phase 1 inquiry's findings of Rule 5 security-safeguard breaches affecting 99,416 patients.

The Commissioner publicly called, on 3 June 2026, for civil-penalty powers following the Manage My Health and Health New Zealand findings, explicitly linking the case to the broader enforcement-architecture gap. As at 18 October 2026, whether this call has produced any government or Cabinet response had not been resolved.

Outlook

The application of the October 2026 compliance notices against Manage My Health and Health New Zealand, and any government response to the Commissioner's 3 June 2026 call for civil-penalty powers, are the two enforcement-architecture developments most likely to shape New Zealand's redress regime going forward.

Enforcement & Redress

New Zealand's enforcement picture this cycle combines a volume signal, a procedural decision, and restated guidance, against a statutory penalty framework that remains narrow. The Office of the Privacy Commissioner's 2024-25 Annual Report is understood to have recorded a 43% increase in the number of serious privacy breaches notified to the regulator, a substantial rise in reported volume. That increase sits against a penalty structure under the Privacy Act 2020 whose only direct financial penalty is a maximum NZ$10,000 fine for an unjustified failure to notify a notifiable breach; New Zealand has no broader civil-penalty regime of the kind operating in Australia, and the Commissioner's enforcement toolkit beyond that notification offence consists principally of binding compliance notices, access directions and codes of practice rather than administrative fines tied to the severity or scale of a breach itself.

Procedurally, decision note PBN4406 shows the Commissioner applying the notifiable-breach test closely, finding that a legal practice's November 2025 notification of an email-account compromise did not capture a separate notifiable breach that had already been identified in forensic findings from May 2025. This kind of decision functions as redress-relevant guidance for the wider regulated community even where it does not itself impose a financial penalty, since the only statutory fine available attaches to a failure to notify, not to the underlying breach.

The Commissioner also published guidance on delayed privacy breach notification, reported around 29 September 2026, restating that organisations should develop incident response plans and notify within 72 hours of recognising a notifiable breach. This restates an existing non-binding expectation rather than introducing a new timeline; the statutory standard remains notification as soon as practicable, with the 72-hour figure operating as the Commissioner's own guidance rather than a fixed legal deadline.

Outlook

The rising volume of notified serious breaches, reported at 43% year on year, sits uneasily against a penalty regime capped at a NZ$10,000 notification offence, and this gap between enforcement pressure and the statutory toolkit is likely to remain a point of commentary. Whether the processor-liability proposal arising separately from the Manage My Health and Health New Zealand inquiry, or any broader civil-penalty reform, is taken up by Parliament remains unconfirmed and should be read as an open question rather than a scheduled development.

Enforcement & Redress

A structural limitation in New Zealand's enforcement toolkit remains material this cycle: the Office of the Privacy Commissioner does not have GDPR-equivalent direct administrative fining powers, despite New Zealand holding an EU adequacy decision. This gap between New Zealand's adequacy status, which is typically associated with GDPR-comparable protections, and its enforcement toolkit, which lacks the direct fining mechanism that underpins GDPR enforcement in the EU, is a standing feature of the regime rather than a new development, but it carries particular salience this cycle given the adequacy-retention rationale attached to the IPP 3A amendment discussed elsewhere in this brief.

Where the OPC's own toolkit does have teeth, it operates through investigative and enforcement powers including the issuing of compliance notices, rather than through direct monetary penalties. Separately, individuals are not left solely dependent on OPC action: they may bring privacy claims before the Human Rights Review Tribunal, which can award damages. This private right of action functions as an independent redress channel that operates regardless of whether the OPC itself pursues an enforcement notice against the same conduct.

The Manage My Health breach notification, discussed under Controller/Processor Duties, is the notable enforcement-adjacent event this cycle, illustrating the mandatory breach-notification regime in active operation, though it did not itself generate a public enforcement action or Tribunal claim within the evidence reviewed this cycle.

Outlook

Whether New Zealand's enforcement architecture evolves toward direct administrative fining powers, closer to the GDPR model, or continues to rely on compliance notices and Tribunal-based private redress, remains an open structural question, and one made more salient by the jurisdiction's adequacy status. The Human Rights Review Tribunal's caseload and damages awards are the practical indicator to watch for how meaningful the private right of action proves in redressing individual harm.

Enforcement & Redress

The Office of the Privacy Commissioner continues to operate without GDPR-equivalent direct administrative fining powers, a materially more limited enforcement toolkit than EU-model data protection authorities. Reports suggest this structural limitation persists despite New Zealand's EU adequacy status and despite this cycle's IPP3A reform substantively aligning notice obligations with EU standards; this is a standing caution flag rather than a new development, carried forward at Probable-consistent, hedged confidence given reliance on a lower-tier source.

Against this backdrop, the Office's finding against Manage My Health and Health NZ, recommending compliance notices and centralised verification measures following a cyber incident, represents active use of the Commissioner's available (non-fining) enforcement tools. Separately, the New Zealand Government's announcement of a new Cyber Security Strategy 2026-2030 and accompanying Action Plan 2026-2027 signals a renewed cross-government push to strengthen resilience to digital threats; this is reported at Probable confidence and represents a forward-looking policy signal rather than a confirmed enforcement-posture change within this monitor's specific remit this cycle.

Outlook

Whether the Office of the Privacy Commissioner has taken any enforcement action specifically citing IPP3A since its 1 May 2026 commencement remains unestablished; no case notes were retrieved this cycle. How the new Cyber Security Strategy interacts with the Commissioner's own enforcement priorities, particularly regarding health-sector security failures of the kind identified against Manage My Health and Health NZ, is the key watch item for the coming cycle.