NZ Privacy Act: The 2026 NZ Guide

The Privacy Act 2020 is New Zealand’s main law for how organisations collect, store, use and share your personal information. It replaced the Privacy Act 1993, added mandatory breach reporting, and gave the regulator real enforcement teeth. This guide explains what the law does in plain language, what changed for 2026, how to actually use your rights, and where privacy tools like a VPN or password manager fit around the legal protections you already have.

What the Privacy Act 2020 covers

The Act took effect on 1 December 2020. It applies to almost every organisation that holds personal information about people in New Zealand — the law calls each of them an agency, a broad term that includes sole traders, charities, large companies and government departments alike.

“Personal information” is defined very widely: it is any information about an identifiable person. That includes your name, email address, phone number, IP address, location history, health records, financial details and even opinions others hold about you. If data can be traced back to a specific individual, it is almost certainly covered.

The Office of the Privacy Commissioner (OPC) oversees the Act. It investigates complaints, issues guidance, and — since 2020 — can issue binding compliance notices requiring an organisation to fix a problem. For a closer look at the regulator’s role, see our guide to the Office of the Privacy Commissioner.

The 13 information privacy principles

At the heart of the Act are 13 Information Privacy Principles (IPPs). They cover the whole life of your data, from the moment it is collected to the moment it must be deleted. Every agency has to follow them.

• IPP 1 – Purpose: Information may only be collected for a lawful purpose connected to the agency’s work, and only if it is actually needed.
• IPP 2 – Source: Personal information should generally be collected directly from the person concerned.
• IPP 3 – Awareness: When collecting from you directly, an agency must tell you who they are, why they want the information, and who they might share it with.
• IPP 4 – Manner of collection: Collection must be fair and not unreasonably intrusive.
• IPP 5 – Storage and security: Agencies must take reasonable steps to protect information from loss, misuse or unauthorised access.
• IPP 6 – Access: You can ask to see the personal information an agency holds about you.
• IPP 7 – Correction: You can ask for wrong information to be corrected.
• IPP 8 – Accuracy: Agencies must check information is accurate before they use or share it.
• IPP 9 – Retention: Information must not be kept for longer than it is needed.
• IPP 10 – Use: Information collected for one purpose generally cannot be used for another without a lawful reason.
• IPP 11 – Disclosure: Sharing personal information with others is restricted to specific lawful grounds.
• IPP 12 – Disclosure outside New Zealand: Sending personal data overseas is only allowed where the recipient offers comparable protection or the person agrees.
• IPP 13 – Unique identifiers: Limits apply to assigning and using unique identifiers such as IRD numbers.

The 2020 Act also made breach reporting compulsory. When an agency reasonably believes a breach has caused, or is likely to cause, serious harm, it must notify both the OPC and the affected people as soon as practicable. Failing to notify without a reasonable excuse is an offence carrying a fine of up to NZD $10,000. Separately, the Human Rights Review Tribunal can award damages of up to NZD $350,000 for a serious interference with someone’s privacy. If you have been affected by a leak, our guide to a privacy breach in New Zealand walks through the steps.

What changed for 2026

Two significant updates take effect around 2026, and they are the main reason to revisit the Act this year.

New principle IPP 3A – indirect collection

The Privacy Amendment Act 2025 (which received Royal assent in September 2025) added a new principle, IPP 3A, that applies from 1 May 2026. It fills a gap in the original IPP 3: when an agency collects your personal information indirectly — that is, from a source other than you, such as a data broker, another business or a public register — it must now take reasonable steps to make sure you are aware of key details, including who has your information and why. In short, the “tell people what you’re doing” duty now extends to information gathered about you behind the scenes.

Biometric Processing Privacy Code 2025

The Biometric Processing Privacy Code came into force on 3 November 2025. It sets specific rules for organisations that process biometric information — face, fingerprint, voice or similar data used to identify people, for example facial recognition in a store. The Code requires a proportionality assessment, transparency, and limits on how biometric data is collected, stored and used, and it incorporates the new IPP 3A indirect-collection duty.

New Zealand specifics: Five Eyes, ISPs and jurisdiction

New Zealand belongs to the Five Eyes intelligence alliance alongside Australia, Canada, the United Kingdom and the United States. That has practical consequences. Under the Telecommunications (Interception Capability and Security) Act 2013 (TICSA), New Zealand internet providers — including Chorus, which runs the UFB fibre network, plus Spark, One NZ and 2degrees — must maintain lawful interception capability. At the infrastructure level, an ISP can be legally compelled to hand traffic data to authorities.

The Privacy Act does not override TICSA or the Intelligence and Security Act 2017. Agencies acting under those laws have their own legal basis to collect and share information, and the Privacy Act carves out national security functions. In practical terms, the Act protects you from commercial misuse of your data far more strongly than it shields you from state surveillance — which is a key reason commercial privacy and surveillance privacy are two different problems.

The overseas-disclosure principle (IPP 12) matters more every year as New Zealand businesses move to cloud services hosted abroad. Sending customer data to a US-based platform, for instance, requires the agency to take reasonable steps to ensure the recipient handles it consistently with the IPPs. The European Union’s adequacy decision for New Zealand — first granted in 2012 and reaffirmed since — lets NZ organisations receive personal data from the EU without extra safeguards, but that recognition does not flow automatically in reverse. You can read more about who provides your connection in our overview of New Zealand internet providers.

Your rights and how to use them

Knowing the law is one thing; exercising your rights is another. Here is how to put the Act to work.

Making an access or correction request

1. Identify the agency that holds your information — your bank, GP, employer, a streaming service or a government department.
2. Send a written request (email is fine) asking to access your personal information. There is no set form, but being specific about what you want speeds things up.
3. The agency must respond as soon as reasonably practicable, and no later than 20 working days. It can extend that in limited cases, but must tell you.
4. If it refuses, it must give reasons. Valid grounds include protecting someone else’s privacy, safety, or legal professional privilege.
5. To fix wrong information, ask for a correction under IPP 7. If the agency declines, it must attach a note recording that you disagree.

Making a privacy complaint

1. Try to resolve it directly with the agency first — the OPC expects this as a starting point.
2. If that fails, file a complaint with the OPC online. There is no fee.
3. The OPC assesses whether the complaint is in scope, then may investigate, mediate or refer it.
4. If the Commissioner finds a breach and the agency will not comply, the matter can go to the Human Rights Review Tribunal for a binding decision and possible damages.

How VPNs and privacy tools fit

A VPN does not create Privacy Act rights — those exist no matter what software you use. What a tool like a VPN does is reduce how much personal information gets generated and retained in the first place, which complements your legal protections. If your ISP cannot see which sites you visit because your traffic is encrypted inside a VPN tunnel, there is simply less metadata for anyone to hold, request or compel.

There is a nuance for the providers themselves. A VPN company becomes an agency under the Act if it operates in New Zealand or collects data about NZ residents. Most large providers are incorporated offshore — in the British Virgin Islands, Panama, Switzerland or elsewhere — so IPP 12’s overseas-disclosure rules apply when a New Zealand user signs up and their data leaves the country. A genuine no-logs policy matters here, because a provider cannot hand over records it never kept. Providers such as Mullvad are often cited for minimal data retention.

On performance: routing through a nearby Australian server typically keeps latency low (often in the 20–40 ms range on a good fibre line), which is comfortable for browsing and streaming. Connections to the US West Coast face a hard physical floor of roughly 130–150 ms because of the distance across the Pacific — fine for streaming, but noticeable for real-time gaming. Actual figures vary with your plan, server load and time of day.

For a shortlist assessed against NZ-specific criteria — jurisdiction, logging policy and local server availability — see our best VPN for New Zealand guide. If budget is tight, our rundown of credible free VPN options explains which ones are safe and which create more risk than they remove.

Tools for privacy and compliance

Whether you are an individual protecting your own data or a small business trying to meet the Act, the right tools depend on your situation. The table below compares the main categories at a glance.

For businesses, process usually matters more than software: a clear privacy statement, a register of the personal information you hold, a breach-response plan and staff training. The OPC publishes free guidance and a privacy-statement generator, which are worth using before paying for a compliance platform. A good password manager is one low-cost step that directly supports the security principle.

NZ streaming services and your data

TVNZ+, ThreeNow, Neon, Sky Sport Now and Whakaata Māori all collect personal information when you create an account or stream. Under the Act, each is an agency and must follow the IPPs. That means you can ask what data they hold, request corrections, and complain to the OPC if they misuse it. Their privacy policies must disclose what they collect, why, and who they share it with — including overseas advertising partners, which brings IPP 12 into play.

Bottom line

The Privacy Act 2020 gives New Zealanders enforceable rights over their personal information — to know what is held, to correct it, and to seek redress when it is misused. Mandatory breach notification, the OPC’s stronger powers, and the 2026 additions of IPP 3A and the Biometric Processing Privacy Code make it meaningfully tougher than the 1993 law it replaced. Where it stops short is at the edge of state power, thanks to Five Eyes obligations and the TICSA and intelligence carve-outs. For everyday privacy — limiting corporate data collection, shrinking your ISP’s metadata footprint and exercising your rights against NZ businesses — the Act combined with sensible habits (encrypted communications, a reputable VPN and a hardened browser) gives you a solid foundation.

Disclaimer

This article is general information about New Zealand privacy law, not legal advice. Laws and official guidance change, and your situation may differ. For authoritative guidance, or before acting on a privacy issue, consult the Office of the Privacy Commissioner (privacy.org.nz) or a qualified legal professional.

Frequently asked questions

Does the Privacy Act 2020 apply to overseas companies?

Yes, with nuance. The Act applies to any agency carrying on business in New Zealand, even if it is incorporated overseas. A company based abroad that actively markets to and collects data from NZ residents is generally caught. Enforcement against offshore entities is harder in practice, but the OPC can still investigate and name organisations publicly. IPP 12 also applies whenever an NZ agency sends your data to an overseas recipient.

What counts as personal information?

Personal information is any information about an identifiable individual. The definition is deliberately broad and includes your name, email, IP address, location, health records, financial details, employment history and opinions others hold about you. Data that has been genuinely anonymised and cannot be linked back to a person falls outside it — though true anonymisation is harder to achieve than many organisations assume.

What is new under IPP 3A in 2026?

IPP 3A, added by the Privacy Amendment Act 2025 and in force from 1 May 2026, covers indirect collection. When an agency gathers your personal information from a source other than you — such as a data broker or another business — it must take reasonable steps to make you aware of key details, including who holds the information and why. It extends the existing transparency duty to data collected about you behind the scenes.

Is using a VPN legal in New Zealand?

Yes. There is no law against using a VPN in New Zealand, and they are widely used by businesses for secure remote access and by individuals for privacy. A VPN does not make you immune from the law — using one to commit a crime is still illegal. ISPs such as Spark, One NZ and 2degrees do not block VPN traffic on standard consumer plans.

Does the Act protect me from government surveillance?

Only partly. The Act applies to government agencies in their ordinary functions, so a department cannot misuse your data any more than a private company can. But it carves out national security and intelligence work. Agencies acting under the Intelligence and Security Act 2017 or TICSA operate under separate frameworks, and New Zealand’s Five Eyes membership means signals-intelligence sharing with allies is lawful under those laws rather than the Privacy Act.

What should a small NZ business do to comply?

Start with the basics: publish a clear privacy statement, collect only what you actually need, store it securely with access controls, and have a documented process for access requests and breach notifications. The OPC’s free resources are a practical starting point. If you handle sensitive data — health, financial or children’s information, or anything biometric — consider a formal assessment before launching new systems. Failing to notify a serious breach can cost up to NZD $10,000, and the reputational damage from a mishandled breach usually costs far more.