NZ Privacy Act

Privacy Act 2020 (New Zealand) — Office of the Privacy Commissioner (New Zealand)

Also known as: Privacy Act 2020, New Zealand Privacy Act, NZ OPC

Official site Official change log Subscribe to NZ Privacy Act (RSS)

Current version: Privacy Act 2020 (version as at 23 September 2026); Published 23 September 2026. source
Status: In force
Next deadline: None announced
Who must comply: New Zealand agencies wherever they act, overseas agencies in the course of carrying on business in New Zealand, and individuals not ordinarily resident here for information collected or held while in New Zealand. source

How it is assessed: Agencies apply the information privacy principles themselves and notify the Commissioner and affected people of notifiable privacy breaches as soon as practicable. source
Authority: An Act of the New Zealand Parliament administered by the Ministry of Justice; the Privacy Commissioner receives breach notifications and can issue compliance notices. source
Enforced by: Offences under the Act, including failing to notify the Commissioner of a notifiable breach, carry fines of up to $10,000. source
Last change: None recorded yet

New Zealand's data protection law, built on fourteen information privacy principles, a mandatory notifiable privacy breach scheme and restrictions on disclosing personal information overseas. Its working detail lives in codes of practice issued by the Privacy Commissioner for health, credit reporting and telecommunications.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

No upcoming dates

Show 1 earlier date

2020-12-01 Most of the Privacy Act 2020 comes into force

Amendments

2026-09-23
Privacy Act 2020 (version as at 23 September 2026) AmendmentCurrent text

Schedule 4 was amended by the Privacy Act (Schedule 4) Order 2026 and the Arms Act 2026, which added Arms Regulator records. source
2026-05-01
Information privacy principle 3A in force Amendment
Part 1 of the Privacy Amendment Act 2025 inserted IPP 3A: an agency that collects personal information about someone from another source must take reasonable steps to make that person aware of the collection. source
More
- The steps must be taken as soon as reasonably practicable after collection; IPP 3A does not apply to information collected before 1 May 2026 (section 25A).
2025-11-27
Statutes Amendment Act 2025 Amendment

Part 31 of the Statutes Amendment Act 2025 made amendments including replacing IPP 12(1)(e) and changes to sections 27, 44, 49 and 120. source
2025-09-24
Privacy Amendment Act 2025, Part 2 Amendment
Part 2 of the Privacy Amendment Act 2025 came into force on 24 September 2025 (section 2(2)), amending sections 18, 22 (the IPP 3 heading), 44, 49 and 63. source
More
- The Commissioner may now assess the privacy laws of a country individually or as a member of a bloc of countries when advising the Minister on comparable safeguards (section 18(3)).
2020-12-01
Privacy Act 2020 (2020 No 31) Major version

The Act received assent on 30 June 2020 and most of it came into force on 1 December 2020. source

Who it applies to

The Act reaches New Zealand agencies wherever they act and overseas agencies carrying on business in New Zealand, regardless of where the information is held.

New Zealand agencies: A New Zealand agency is covered for any action on personal information it collects or holds, whether or not it is present in New Zealand at the time (section 4(1)(a)). source
Overseas agencies: An overseas agency is covered for actions in the course of carrying on business in New Zealand, which does not require a place of business or payment in New Zealand (section 4(1)(b) and (3)). source
Location of data: It does not matter where the information was collected or is held, or where the individual is located (section 4(2)). source

How compliance is assessed

Agencies apply the information privacy principles themselves and notify the Commissioner and affected people of notifiable privacy breaches as soon as practicable.

Breach notification: An agency must notify the Commissioner as soon as practicable after becoming aware of a notifiable privacy breach (section 114). source
Affected individuals: It must also notify affected individuals as soon as practicable, or give public notice where individual notification is not reasonably practicable (section 115). source
Indirect collection: Since 1 May 2026, an agency collecting personal information from someone other than the individual must take reasonable steps to make the individual aware of the collection, its purpose and recipients (IPP 3A). source

Enforcement and penalties

Offences under the Act, including failing to notify the Commissioner of a notifiable breach, carry fines of up to $10,000.

Up to $10,000

Section 118, for an agency that without reasonable excuse fails to notify the Commissioner of a notifiable privacy breach. source

Up to $10,000

Section 212, for obstructing the Commissioner, failing to comply with a lawful requirement, misleading an agency to obtain someone's information, or destroying requested documents. source

Compliance notices: The Commissioner can issue compliance notices to agencies (section 123). source

Documents

Law text Privacy Act 2020 (latest version)
Law text Privacy Amendment Act 2025 (2025 No 53)

Frequently asked questions

What is IPP 3A in the New Zealand Privacy Act?

A principle in force from 1 May 2026: an agency that collects personal information from someone other than the individual must take reasonable steps to make the individual aware of the collection, its purpose, the recipients and their access and correction rights. source

What is the maximum penalty under the New Zealand Privacy Act 2020?

Offences under the Act, such as failing to notify the Commissioner of a notifiable privacy breach, are punishable by a fine of up to $10,000 (sections 118 and 212). source

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to NZ Privacy Act (RSS)

At a glance