Regulations › Rest of world › New Zealand
Privacy Act
Privacy Act 2020
WhenIn effect since 1 December 2020
Who enforces itOffice of the Privacy Commissioner
Who it applies toEvery agency in New Zealand and overseas agencies carrying on business in New Zealand.
Tell the regulatorNotify the Commissioner as soon as practicable after becoming aware of a notifiable breach (OP…
DPO requiredEvery agency must appoint one or more privacy officers
RegistrationNo registration
Transfers abroadOverseas disclosure allowed only with comparable safeguards, consent after warning, prescribed…
Request deadlineRespond no later than 20 working days after receipt (about 28 calendar days)
Maximum fineCriminal fines up to NZD 10,000 (e.g
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
2
Applies to overseas agencies carrying on business in New Zealand, even without a place of business or commercial purpose.s.4(1)(b), (3) · source ↗
Lawful basis
1
No lawful-basis list; collection must be for a lawful purpose connected to the agency's functions and necessary for it.s.22 IPP 1, IPP 10 · source ↗
Consent
0
Consent not defined; authorization can be implied in context.s.22 IPPs 10-11 · source ↗
No express consent standard in the Act.
Sensitive data
0
No special category in the Act; Biometric Processing Privacy Code 2025 regulates biometrics.None (Biometric Processing Privacy Code 2025) · source ↗
Code not fetched this session.
Children
1
No age threshold; collection must be fair and not unreasonably intrusive, particularly from children or young persons.s.22 IPP 4 · source ↗
Scored 1 for a children-specific rule without an age; s.49 refers to under-16s in access refusals.
People's rights
Request deadline
2
Respond no later than 20 working days after receipt (about 28 calendar days).s.44(1) · source ↗
Marketing
2
Commercial electronic messages require consent under the Unsolicited Electronic Messages Act 2007.UEMA 2007 s.9 · source ↗
Separate Act; section from recall, not verified.
Governance
DPO required
3
Every agency must appoint one or more privacy officers.s.201 · source ↗
Section from the Act; excerpt read did not include this section's text.
DPO qualifications
–
Not addressedNone · source ↗
Section from the Act; excerpt read did not include this section's text.
DPIA
1
Not required; Commissioner recommends privacy impact assessments.None (OPC guidance) · source ↗
Breaches
Tell the regulator
1
Notify the Commissioner as soon as practicable after becoming aware of a notifiable breach (OPC guide: within 72 hours).s.114 · source ↗
Tell people
2
Notify affected individuals as soon as practicable where serious harm is likely, or give public notice.s.115 · secondary source · source ↗
Transfers
Transfers abroad
2
Overseas disclosure allowed only with comparable safeguards, consent after warning, prescribed binding scheme or country, or contract.s.22 IPP 12 · source ↗
Enforcement
Maximum fine
1
Criminal fines up to NZD 10,000 (e.g. failing to notify a breach).ss.118, 212 · secondary source · source ↗
Section numbers from recall; amount confirmed via Baker McKenzie.
Criminal liability
1
Limited offenses (misleading agencies, destroying requested information, failing to notify breach); fines only.ss.118, 212 · secondary source · source ↗
Private action
2
After a Commissioner complaint, individuals may bring proceedings in the Human Rights Review Tribunal for damages.ss.98, 103 · source ↗
Must go through complaint process first.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws