| NZ Privacy Act compliance means handling personal information in line with the Privacy Act 2020: its 13 information privacy principles, IPP 3A for information collected from someone else, breach notification and the other duties the Act sets. For your IT, it means controls and processes that support those duties. |
This guide covers the practical IT side of NZ Privacy Act compliance: which duties your systems support, what to do about overseas cloud services, how breach notification works, and who should own each part. It is general information, not legal advice. The Office of the Privacy Commissioner (OPC) publishes the full rules, and your privacy officer or legal adviser should confirm how they apply to your business.
Need help with the technical controls? See our cyber security services.
What does NZ Privacy Act compliance involve?
The Privacy Act 2020 came into force on 1 December 2020, replacing the 1993 Act. It sets rules for collecting, storing, using and disclosing personal information, requires notification of serious privacy breaches, and controls how information is sent overseas. The Privacy Amendment Act 2025 added IPP 3A, in force since May 2026.
No single tool or certificate delivers NZ Privacy Act compliance. It depends on what information you hold, why you hold it, who can reach it and how you respond when something goes wrong, which is why the IT controls and the business processes have to work together.
Who does the Privacy Act apply to?
It applies to agencies that hold personal information, which covers businesses of every size, sole traders, charities and schools. There is no minimum size threshold. What counts as reasonable protection depends on the information and the circumstances, not only on company size.
What counts as personal information?
Personal information is information about an identifiable individual: names, contact details, IRD numbers, employment records, health details, photos and purchase history, among others. It turns up in obvious places like a CRM and in less obvious ones like email archives, voicemail, shared drives, backups and old laptops. Knowing where it lives is the starting point for NZ Privacy Act compliance.
The principles behind NZ Privacy Act compliance
The Act has 13 information privacy principles plus IPP 3A. The summaries below are high level. Exceptions apply to many principles, and sector codes such as the Health Information Privacy Code modify them for some industries, so use OPC’s principles pages for the full wording.
| Principle | What it covers |
|---|---|
| IPP 1 to 4 | Collecting information for a lawful purpose, from the person where possible, with the person told what is collected and why, in a fair way. |
| IPP 3A | Telling people when their information is collected from someone else. |
| IPP 5 | Reasonable safeguards against loss, misuse and unauthorised access or disclosure. |
| IPP 6 and 7 | A person’s right to access their information and ask for it to be corrected. |
| IPP 8 to 11 | Checking accuracy before use, not keeping information longer than lawfully needed, and limits on use and disclosure. |
| IPP 12 | Disclosing personal information to a recipient overseas. |
| IPP 13 | Assigning and using unique identifiers. |
IPP 3A: collecting information from someone else
IPP 3A is the newest part of NZ Privacy Act compliance. Since 1 May 2026, IPP 3A has added notification duties when an agency collects personal information from someone other than the individual. First check that indirect collection is permitted under IPP 2. Then take reasonable steps, as soon as reasonably practicable after collection unless done sooner, to make the person aware of the collection, its purpose, intended recipients, the collecting and holding agencies’ names and addresses, any law authorising or requiring it, and their access and correction rights. Exceptions apply.
A common example is a business receiving a prospective customer’s details from a referrer. Record each incoming referral and data-supply route, who sends the notice, and any exception you rely on. A generic privacy policy alone does not establish that the required notification happened. OPC’s IPP 3A guidance lists the exceptions.
Start NZ Privacy Act compliance with a privacy officer
Every agency needs at least one person fulfilling the privacy officer role. It can be part of an existing job rather than a new full-time position. Give that person a clear escalation route and access to the business and technical owners, and make sure staff know who to contact about requests, concerns and possible breaches. OPC has guidance for privacy officers. The table below suggests who owns each part of NZ Privacy Act compliance.
| Action | Suggested owner | Practical completion point |
|---|---|---|
| Map personal information | Business owners and IT | Systems, purpose, access and recipients recorded. |
| Check collection and notices | Privacy officer | Direct and indirect collection routes reviewed. |
| Review access and safeguards | IT and system owners | Permissions, authentication and protections checked. |
| Set retention and retrieval | Privacy officer and records owners | Lawful retention and request-handling process agreed. |
| Review providers | Business owner and IT | Responsibilities, uses and escalation terms understood. |
| Practise breach response | Privacy officer, leadership and IT | Team can assess, contain and escalate a scenario. |
IT controls that support NZ Privacy Act compliance
IPP 5 requires reasonable safeguards, and the Act does not prescribe a technology stack. What is reasonable depends on the information, how sensitive it is and the circumstances. The controls below are practical ways to support that duty. Installing them does not by itself establish NZ Privacy Act compliance. For a deeper look at Principle 5, see our guide to Privacy Act cybersecurity safeguards.
Access controls and authentication
Limit access to the people who need it for their role, use multi-factor authentication on business accounts, and remove access promptly when people leave or change roles. Shared logins and stale permissions make NZ Privacy Act compliance hard to show, because nobody can say who could reach what.
Encryption, and its limits
Encryption is one of the controls behind NZ Privacy Act compliance. It protects information on lost devices, in backups and while it moves between systems. It has limits: transport encryption does not stop a recipient misusing a message once it is delivered, and encrypted data is only as safe as the accounts and keys that unlock it. Our guide to email encryption covers the options.
Retention and disposal
IPP 9 says not to keep personal information longer than is required for the purposes for which it may lawfully be used. Set retention periods by record type, taking account of other recordkeeping duties and any legal holds, and include archives and backups in the process. Dispose of devices and media securely.
Backups and recovery
Backups support NZ Privacy Act compliance by helping protect information against loss, and recoverability is unverified until a restore has been tested. Keep backup retention separate from your records retention rules, so backups do not become an indefinite archive. Our data backup strategy guide covers the setup.
Logging and monitoring
Logs across devices, email and cloud services help you notice unauthorised access and work out what happened, which you need in order to assess a breach and show what was affected. Decide who reviews alerts and how long logs are kept.
Layering these controls, known as defence in depth, means one failure does not expose everything. A cybersecurity risk assessment helps decide which controls matter for the information you hold.
Can a New Zealand business use overseas cloud services?
Yes. Storing information overseas is not automatically a disclosure under IPP 12. Where a provider only stores or processes personal information on your behalf and does not use or disclose it for its own purposes, section 11 generally treats your business as holding that information. You remain responsible for protecting it.
If an overseas provider uses the information for its own purposes, consider whether the arrangement is a disclosure permitted by IPP 11 and whether IPP 12 applies. Where it does, establish an applicable basis, such as comparable legal or contractual safeguards. If relying on the individual’s authorisation because comparable safeguards may be absent, expressly tell them that before they authorise the disclosure.
OPC’s guidance on third-party providers and its IPP 12 decision tree walk through the questions. Keep a record of each provider holding personal information, what it does with the information and where it is held, which makes NZ Privacy Act compliance easier to show. Which country’s law can compel a provider to hand information over is a separate question, covered in our guide to data sovereignty.
Notifiable privacy breaches
Breach notification is the part of NZ Privacy Act compliance with the tightest timing. A notifiable privacy breach is one that has caused, or is likely to cause, serious harm to affected people. Not every incident is notifiable, and the type of information alone does not decide it. The assessment weighs factors such as how sensitive the information is, who has obtained or may obtain it, whether it was protected, the kind of harm that could follow and how likely it is.
How quickly must we report?
Notify the Privacy Commissioner as soon as practicable after becoming aware of a notifiable privacy breach. OPC expects notification within 72 hours of becoming aware that it is a notifiable breach, even if the investigation is continuing. That timeframe is a guide, not a fixed statutory deadline or permission to wait. Affected people must also be notified as soon as practicable, subject to the Act’s exceptions and permitted delays. Use NotifyUs and update the report as facts become clearer.
Service providers and breach awareness
Agree prompt escalation with service providers. A provider acting as your agent can become aware of a breach before your own team does, and responsibility does not necessarily begin only when the provider tells you. Our guide to an incident response plan covers the first hours.
Penalties
Failing to notify the Commissioner of a notifiable privacy breach without reasonable excuse is an offence, with a maximum fine of $10,000 on conviction. That fine does not apply to every privacy breach and does not cap other consequences: the Commissioner can issue compliance notices, and affected people can complain and ultimately bring proceedings before the Human Rights Review Tribunal, which can award damages.
Common NZ Privacy Act compliance mistakes
- Treating it as a one-off project. NZ Privacy Act compliance is ongoing, because systems, suppliers and staff change. We recommend reviewing your privacy controls at least annually and whenever a new system handles personal information.
- Assuming providers handle everything. A provider acting on your behalf does not take over your responsibility for protecting the information.
- Relying on a privacy policy alone. A policy does not show that collection notices, IPP 3A notifications or access requests were handled.
- No practised breach response. Decide in advance who assesses, contains, notifies and communicates, and practise a scenario.
- Training once. Train staff at induction, refresh it, and update it when roles or systems change.
Handling access requests
People can ask whether you hold information about them and ask to see it. The Act gives you 20 working days to decide on a request, and that time can be extended in permitted circumstances. Make sure your systems let you find a person’s information across email, files and applications, because access requests test NZ Privacy Act compliance in practice.
Frequently Asked Questions
What is NZ Privacy Act compliance?
NZ Privacy Act compliance means handling personal information in line with the Privacy Act 2020, including the information privacy principles, IPP 3A and breach notification. It is ongoing rather than a one-off project. For IT, it means controls and processes that support those duties.
Does the Privacy Act apply to small businesses?
Yes. NZ Privacy Act compliance duties apply to agencies holding personal information, with no minimum size threshold, so sole traders and small businesses are covered. What counts as reasonable protection depends on the information and the circumstances, not only on company size.
How many information privacy principles are there?
The Privacy Act 2020 has 13 information privacy principles plus IPP 3A, which the Privacy Amendment Act 2025 added from May 2026. Exceptions apply to many principles, and sector codes modify them for some industries. The Office of the Privacy Commissioner publishes the full wording.
What is IPP 3A?
IPP 3A requires an agency that collects personal information from someone other than the individual to take reasonable steps to tell that person. The notice covers the collection, its purpose, intended recipients, the agencies involved, any law requiring it, and access and correction rights. It applies from 1 May 2026, and exceptions apply.
Can a New Zealand business use overseas cloud services?
Yes. Where a provider only stores or processes personal information on your behalf and does not use it for its own purposes, section 11 generally treats your business as holding it, so it is not automatically a disclosure under IPP 12. You remain responsible for protecting it. If the provider uses the information for its own purposes, IPP 11 and IPP 12 need to be considered.
What is a notifiable privacy breach?
It is a privacy breach that has caused, or is likely to cause, serious harm to affected people. Not every incident is notifiable, and the type of information alone does not decide it. The assessment weighs sensitivity, who has the information, any protection in place and the likely harm.
How quickly must we report a privacy breach?
Notify the Privacy Commissioner as soon as practicable after becoming aware of a notifiable privacy breach. The Office of the Privacy Commissioner expects this within 72 hours of becoming aware, as a guide, even if the investigation is continuing. Affected people must also be notified as soon as practicable, subject to the exceptions and permitted delays in the Act.
What is the penalty for failing to notify a privacy breach?
Failing to notify the Commissioner of a notifiable privacy breach without reasonable excuse is an offence with a maximum fine of $10,000 on conviction. The fine does not apply to every privacy breach. Compliance notices and proceedings before the Human Rights Review Tribunal are separate consequences.
Do we need a privacy officer?
NZ businesses and organisations need at least one person fulfilling the privacy officer role. It can be part of an existing job, and that person coordinates NZ Privacy Act compliance day to day. Make sure staff know who to contact about requests, concerns and possible breaches.
How does multi-factor authentication support NZ Privacy Act compliance?
Multi-factor authentication is one practical control that supports the reasonable safeguards required by IPP 5. It makes it harder for someone with a stolen password to reach accounts holding personal information. The Act does not mandate a particular tool, so it works alongside access reviews, monitoring and other controls.
NEXT STEP
Need help putting the technical controls in place?
Exodesk can help with the technical side of NZ Privacy Act compliance: access, device and cloud security, backup and recovery. Your privacy officer leads the wider privacy programme, with legal advice where needed. We work with businesses across New Zealand.
Or contact us to talk it through.
