New Zealand Privacy Act 2020 Compliance with ConsentX

The 13 Information Privacy Principles

The Privacy Act contains 13 Information Privacy Principles governing how agencies handle personal information:

• IPP 1, Purpose of collection: personal information must be collected for a lawful purpose connected with the agency's functions or activities, and the collection must be necessary for that purpose.
• IPP 2, Source of personal information: information should generally be collected directly from the individual concerned, subject to specified exceptions.
• IPP 3, Notice when collecting directly: when information is collected directly from an individual, reasonable steps must generally be taken to explain why it is being collected, who will receive it, whether providing it is compulsory or voluntary, and what happens if it is not provided.
• IPP 3A, Notice for indirect collection: effective 1 May 2026, organisations collecting personal information from another source must generally take reasonable steps to ensure the individual knows that the information was collected, the purpose of collection, intended recipients, relevant agency details, applicable legal authority, and their access and correction rights, subject to exceptions.
• IPP 4, Fair and reasonable collection: personal information must be collected by lawful means and in a way that is fair and reasonable in the circumstances.
• IPP 5, Storage and security: agencies must take reasonable safeguards to protect personal information against loss, unauthorised access, use, modification, disclosure, or other misuse.
• IPP 6, Access: individuals generally have the right to request access to their personal information.
• IPP 7, Correction: individuals can request correction of personal information that is inaccurate, incomplete, misleading, or otherwise incorrect.
• IPP 8, Accuracy: before using or disclosing personal information, agencies must take reasonable steps to ensure that it is accurate, complete, relevant, and not misleading.
• IPP 9, Retention: personal information should not be kept for longer than is required for the purposes for which it may lawfully be used.
• IPP 10, Use: personal information should generally only be used for the purpose for which it was collected, subject to specified exceptions.
• IPP 11, Disclosure: agencies must control disclosure of personal information and generally disclose it only in circumstances permitted by the Privacy Act.
• IPP 12, Overseas disclosure: specific requirements apply when personal information is disclosed to organisations or people outside New Zealand.
• IPP 13, Unique identifiers: the use and assignment of unique identifiers are subject to additional requirements.

Does New Zealand Require Consent?

No. The Privacy Act 2020 does not impose a blanket consent requirement for all personal information processing.

The Act is primarily based on the Information Privacy Principles. An organisation may be able to collect, use, or disclose personal information without obtaining consent where the relevant IPP permits the activity.

However, transparency and fair collection are central requirements. Organisations should clearly explain what information they collect, why they collect it, who may receive it, and how it will be used.

Consent can still be relevant in specific circumstances, including particular disclosures, overseas transfers, marketing activities, or where another applicable law requires consent.

Cookie Consent and Tracking

New Zealand does not have a standalone blanket cookie-consent requirement equivalent to the consent regimes found in some other jurisdictions.

However, cookies and online tracking can involve the collection, use, or disclosure of personal information. Organisations should therefore consider whether their collection practices comply with the Information Privacy Principles, particularly requirements relating to:

• Purpose of collection
• Transparency
• Fairness
• Security
• Use and disclosure
• Retention

For websites using analytics, advertising technologies, pixels, session recording, or other tracking technologies, a clear privacy and tracking notice can help explain what information is collected and why.

Where consent is required under another applicable law, contractual requirement, platform rule, or the organisation's chosen compliance framework, ConsentX can also support consent collection and evidence.

Privacy Notices and Transparency

Transparency is a central requirement under the Privacy Act.

When collecting personal information directly, organisations should generally explain:

• What information is being collected
• Why the information is being collected
• Who will receive the information
• Whether providing the information is compulsory or voluntary
• What may happen if the individual does not provide it

The introduction of IPP3A from 1 May 2026 adds similar transparency requirements for indirect collection, subject to specified exceptions.

ConsentX can help organisations present concise collection and tracking notices at the point where information is collected.

Indirect Collection of Personal Information: IPP3A

One of the most important recent New Zealand privacy developments is Information Privacy Principle 3A.

IPP3A applies when an organisation collects personal information about an individual from someone or something other than the individual themselves.

Where applicable, the organisation must take reasonable steps to ensure the individual is aware of:

• The fact that their information has been collected
• The purpose of the collection
• Intended recipients
• The name and address of the collecting agency
• The agency holding the information
• The relevant law where the collection is authorised or required by law
• Their rights to access and correct the information

IPP3A contains exceptions, so organisations should assess whether a particular collection falls within an exception rather than treating the notification obligation as universal.

Sensitive Personal Information

The Privacy Act does not use a single comprehensive “sensitive personal information” category in the same way as some other privacy laws.

Instead, the fairness and reasonableness of collection can depend on factors including:

• The nature of the information
• The purpose for collection
• The individual concerned
• The circumstances in which information is collected
• The degree of intrusion into privacy

Organisations should take particular care when collecting information that could create significant privacy risks, including health, financial, biometric, identity, children's, or other highly personal information.

New Zealand also has sector-specific privacy codes, including rules covering health information, telecommunications information, credit reporting, and biometric processing.

Data Subject Rights

The Privacy Act provides individuals with important rights relating to their personal information.

Right to access. Individuals can request access to personal information held about them. Agencies generally need to respond to access requests within 20 working days, subject to the Act's provisions for extensions and other circumstances.

Right to correction. Individuals can request correction of personal information that is inaccurate, incomplete, misleading, or otherwise incorrect.

Right to complain. Individuals can complain to the Office of the Privacy Commissioner where they believe their privacy rights have been interfered with.

ConsentX can support structured request intake and workflow management for access and correction requests.

Privacy and Security

Agencies must take reasonable safeguards to protect personal information against:

• Loss
• Unauthorised access
• Unauthorised disclosure
• Unauthorised use
• Modification
• Other misuse

Security controls should be proportionate to the nature and sensitivity of the information and the risks involved.

Organisations should also maintain processes for identifying, containing, investigating, documenting, and responding to privacy incidents.

Notifiable Privacy Breaches

A privacy breach becomes notifiable when personal information has been accessed, disclosed, altered, lost, or destroyed without authorisation and it is reasonable to believe that the affected individual has suffered, or is likely to suffer, serious harm.

A notifiable privacy breach must be reported to the Office of the Privacy Commissioner as soon as practicable after the agency becomes aware that the criteria have been met.

The OPC currently expects notification generally within 72 hours, unless there are circumstances justifying a different timeframe. The statutory wording itself uses “as soon as practicable” rather than establishing a universal 72-hour statutory deadline.

Affected individuals may also need to be notified.

ConsentX can help maintain evidence and records that support privacy incident investigation and compliance workflows.

Overseas Data Transfers

Information Privacy Principle 12 governs certain disclosures of personal information outside New Zealand.

Before making a covered overseas disclosure, an organisation generally needs to establish that the recipient:

• Is subject to the New Zealand Privacy Act
• Is subject to privacy laws providing comparable safeguards
• Has agreed to provide adequate privacy safeguards
• Is covered by an applicable binding scheme or prescribed country
• Or that the individual has authorised the disclosure after being expressly informed that the information may not receive comparable protection

Importantly, IPP12 does not automatically apply to every offshore cloud-storage or processing arrangement. Where an overseas provider acts only as an agent for storage or processing, the information may continue to be treated as held by the New Zealand agency under section 11.

Organisations should therefore distinguish between disclosure to an overseas recipient and use of an overseas service provider as an agent.

Data Retention and Deletion

IPP9 limits how long agencies can retain personal information.

Personal information should not be kept for longer than required for the purposes for which it may lawfully be used.

Organisations should establish appropriate retention and disposal processes based on:

• The purpose of processing
• Legal and regulatory requirements
• Contractual obligations
• Business requirements
• Security considerations

The Privacy Act does not create a blanket GDPR-style right to erasure. However, deletion or disposal may be required or appropriate in particular circumstances.

Privacy Officers

Every agency covered by the Privacy Act is required to have a privacy officer.

The privacy officer is responsible for helping the organisation comply with the Act, dealing with access and correction requests, and working with the Privacy Commissioner during investigations.

The role does not require a particular formal qualification, but the privacy officer should understand the organisation's privacy obligations and information-handling practices.

Privacy Codes of Practice

The Privacy Act gives the Privacy Commissioner the ability to issue codes of practice that modify how the privacy principles apply to particular industries, organisations, or types of information.

Examples include:

• Health Information Privacy Code
• Credit Reporting Privacy Code
• Telecommunications Information Privacy Code
• Biometric Processing Privacy Code

Organisations operating in regulated sectors should therefore assess both the Privacy Act and any applicable privacy code.

Biometrics and Emerging Technologies

New Zealand has introduced specific regulatory requirements around biometric processing.

The Biometric Processing Privacy Code 2025 came into force on 1 May 2026, with amendments made to reflect the introduction of IPP3A.

Organisations using facial recognition, fingerprints, voice recognition, behavioural biometrics, or other biometric technologies should assess whether the Biometric Processing Privacy Code applies in addition to the general Privacy Act requirements.