New Zealand Privacy Act
Amended New Zealand · In force Dec 1, 2020 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
New Zealand's privacy law, built on 13 Information Privacy Principles plus mandatory notification of serious privacy breaches. The Privacy Amendment Act 2025 adds IPP 3A from 1 May 2026: agencies that collect personal information indirectly (from third parties) must take reasonable steps to tell the individual about the collection, its purpose, recipients and their rights.
- Who it applies to
- All 'agencies' (public and private sector, any size) that collect or hold personal information, including overseas agencies carrying on business in New Zealand.
- Penalties
- Criminal fines up to NZD 10,000 for offences such as failing to notify a notifiable privacy breach, misleading an agency, or ignoring a compliance notice. The Human Rights Review Tribunal can award damages.
- Enforced by
- Office of the Privacy Commissioner; Human Rights Review Tribunal
- Official name
- Privacy Act 2020 (New Zealand), as amended by the Privacy Amendment Act 2025
- Citation
- Privacy Act 2020 (2020 No 31); Privacy Amendment Act 2025
- Topics
- privacy, breach-notification
Verified 2026-09-22 privacy.org.nz
Research notes
The 2020 Act assent date (30 Jun 2020) and the NZD 10,000 penalty come from established knowledge, not re-fetched.
Related
Australia Cyber Security Act (ransomware reporting)
Hong Kong Critical Infrastructure Cyber OrdinanceQuestions about New Zealand Privacy Act
- What are the New Zealand Privacy Act compliance deadlines?
- Dec 1, 2020: Privacy Act 2020 in force. Sep 24, 2025: Privacy Amendment Act 2025 technical changes commence. May 1, 2026: IPP 3A indirect-collection notification applies.
- When does New Zealand Privacy Act take effect?
- New Zealand Privacy Act took effect on Dec 1, 2020.
- Who does New Zealand Privacy Act apply to?
- All 'agencies' (public and private sector, any size) that collect or hold personal information, including overseas agencies carrying on business in New Zealand.
- What are the penalties under New Zealand Privacy Act?
- Criminal fines up to NZD 10,000 for offences such as failing to notify a notifiable privacy breach, misleading an agency, or ignoring a compliance notice. The Human Rights Review Tribunal can award damages.