Cookie consent in New Zealand / Aotearoa
Consent and privacy law in New Zealand / Aotearoa
Privacy Act 2020 in force since December 2020, with 13 information privacy principles
en
Who must comply
Agencies in New Zealand and overseas businesses that carry on business in New Zealand and handle personal information of people there.
Penalties
Fines up to 10,000 New Zealand dollars for offences, plus compensation orders
Key obligations
- Collect personal information only for a lawful, clear purpose
- Be transparent about collection and use
- Give individuals access to and correction of their information
- Apply reasonable security safeguards
- Notify the Commissioner and affected people of notifiable breaches
Local guidance
- Apply the 13 information privacy principles
- Notify serious harm breaches to the Commissioner
- Use the cross border transfer principle for overseas disclosures
- Rely on EU adequacy for transfers
How ConsentX helps
- Transparent purpose notice in the banner
- Preference and access request intake
- Consent and preference receipts
- Breach-ready evidence logs
- Region rule engine tuned for New Zealand
We value your privacy
We ask for your consent before any non-essential cookie, with the rules that apply in your region.
This page is a plain-English summary for general information and is not legal advice. Confirm your obligations with qualified local counsel.
How to comply with New Zealand using ConsentX
- 1
Scan your website
Run a free scan to find every cookie and tracker on your site, so you know exactly what needs consent under New Zealand.
- 2
Show a geo-aware consent banner
Add the ConsentX banner. It detects each visitor region and shows the consent experience that New Zealand requires, automatically.
- 3
Block trackers until consent
Keep non-essential cookies and trackers blocked until the visitor agrees, so nothing fires before consent.
- 4
Record tamper-evident proof
Every choice is stored as a tamper-evident consent receipt you can produce in a New Zealand audit.
- 5
Handle data requests on time
Use the built-in DSAR workflow with SLA timers to answer access, deletion and opt-out requests within the legal deadline.
Frequently asked questions
Does New Zealand require breach notification?+
Yes. The Privacy Act 2020 requires notification to the Commissioner and affected individuals when a privacy breach causes or is likely to cause serious harm.
Does New Zealand have EU adequacy?+
Yes. New Zealand holds an EU adequacy decision, allowing personal data to flow freely from the EU to New Zealand.