New Zealand’s Privacy Act 2020 establishes rules for handling personal information through 13 IPPs, covering collection, storage, access, accuracy, use, disclosure, and unique identifiers. The Privacy Amendment Act 2025 introduced IPP 3A (effective 1 May 2026), adding a notification requirement for indirect collection
Purpose of this Act: The purpose of this Act is to promote and protect individual privacy by—
(a)providing a framework for protecting an individual’s right to privacy of personal information, including the right of an individual to access their personal information, while recognising that other rights and interests may at times also need to be taken into account; and
(b)giving effect to internationally recognised privacy obligations and standards in relation to the privacy of personal information, including the OECD Guidelines and the International Covenant on Civil and Political Rights.
1. Purpose of Collection – Personal information must only be collected for a lawful purpose connected to the organization’s functions or activities.
2. Source of Information – Information should generally be collected directly from the individual concerned, unless exceptions apply.
3. Collection from Individual – Individuals must be informed about the collection, including the purpose, who will access it, and consequences of not providing it.
3A. Indirect Collection Notification – Organizations must notify individuals when personal information is collected from other sources.
4. Manner of Collection – Collection must be fair, lawful, and not unreasonably intrusive.
5. Storage and Security – Agencies must protect personal information against loss, unauthorized access, or misuse.
6. Access – Individuals have the right to access their personal information.
7. Correction – Individuals can request correction of inaccurate or incomplete information.
8. Accuracy, Completeness, and Relevance – Information must be accurate, up-to-date, and relevant for its intended purpose.
9. Retention – Personal information should not be kept longer than necessary for the purpose it was collected.
10. Use – Information must only be used for the purpose it was collected or directly related purposes.
11. Disclosure – Disclosure to third parties is limited to purposes consistent with the original collection or as legally required.
12. Unique Identifiers – Agencies should avoid assigning unique identifiers unless necessary for lawful purposes.
13. Compliance and Risk Management – Agencies must take proactive steps to prevent privacy risks and ensure compliance with the Act
The Act directly shapes IT operations: Data collection systems must include consent, purpose statements, and fair collection mechanisms.
Databases and cloud storage must meet IPP5 security safeguards—encryption, access controls, audit logs.
APIs and integrations must ensure accuracy (IPP8) and limit disclosure (IPP11).
Data retention policies must automate deletion or anonymisation (IPP9).
Incident response plans must include notifiable breach processes introduced in 2020.
Privacy-by-design becomes mandatory for software development and system architecture.
● Māori data refers to digital or digitisable information or knowledge that is about or from Māori people, our language, culture, resources or environments.
● Māori Data Sovereignty refers to the inherent rights and interests that Māori have in relation to the collection, ownership, and application of Māori data.
● Māori Data Governance refers to the principles, structures, accountability mechanisms, legal instruments and policies through which Māori exercise control over Māori data.
NZ Privacy Act cybersecurity requires every business to protect the personal information it holds with security safeguards that are reasonable for the sensitivity of that data. This obligation sits at the heart of the Privacy Act 2020 and applies to organisations of every size.The current legislation is the Privacy Act 2020, which replaced the earlier 1993 Act and came into force on 1 December 2020. It is built around 13 information privacy principles that cover the full lifecycle of personal data, from how it is collected through to how it is stored, used, disclosed, and eventually disposed of.Personal information means any information about an identifiable individual. For most businesses that includes customer records, staff files, email addresses, payment details, and health or financial data. If your systems hold any of this, the Act applies to you.
Cybersecurity supports NZ Privacy Act compliance by turning a legal obligation into working technical controls. The Act says you must protect personal information, and your security tools, policies, and processes are how you actually do it.Without controls in place, a business is exposed on two fronts. It risks a breach that harms customers, and it risks being found to have failed its legal duty to protect data. Good NZ Privacy Act cybersecurity closes both gaps at once, because the same controls that stop a breach also demonstrate compliance.
References: