Privacy Act 2020, Information Privacy Principles and Extraterritorial Reach
Privacy Act 2020 (NZ), No 31, ss. 4, 22 (IPP 1, 2, 13)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 December 2020.
A comprehensive regime rule binding public and private bodies.
As of 6 September 2026.
What it requires
- Do not collect personal information unless it is for a lawful purpose connected with a function or activity of your organisation and the collection is necessary for that purpose.
- Collect personal information directly from the individual concerned unless an exception applies, such as the individual's authorisation, the source being a publicly available publication, or non-compliance not prejudicing the individual's interests.
- Comply with the Information Privacy Principles as an overseas organisation if you are carrying on business in New Zealand in relation to personal information you collect or hold, even without a New Zealand place of business, staff, or profit motive.
- Do not assign a unique identifier to an individual unless it is necessary to carry out your organisation's functions efficiently, and do not assign the same identifier already assigned by another agency except in limited circumstances.
If you get it wrong
Private right of actionNo
Who enforces it
Enforcement body
Office of the Privacy Commissioner
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Binds a New Zealand agency for any action taken anywhere in respect of personal information it collects or holds, and an overseas agency for any action taken in the course of carrying on business in New Zealand, which section 4(3) confirms does not require a commercial operation, a New Zealand place of business, payment, or a profit motive.
Information privacy principle 1 confines collection to what is necessary for a lawful purpose connected with the agency's function, information privacy principle 2 requires collection directly from the individual concerned subject to listed exceptions including that the source is a publicly available publication, and information privacy principle 13 limits an agency's assignment of unique identifiers to what is necessary to carry out its functions.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachhigh_risk_decisions
Read the law
official consolidated Act text, New Zealand Legislation