← Global Privacy Laws Research Library
31 of 2020
Privacy Act 2020
Privacy Act 2020: New Zealand
Prepared by Shubhank Suman · Last reviewed
CURRENT / IN FORCE
What it covers
The Act governs personal information through:
- 13 Information Privacy Principles
- access/correction rights
- Privacy Commissioner supervision
- complaints
- compliance notices
- notifiable privacy breaches
- information sharing
- information matching
- overseas disclosures/transfers
- privacy officers.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: High
AI
MODERATE/HIGH
The Act is not AI-specific.
However, AI systems that process personal information remain subject to the IPP framework, and information matching/automated analysis can raise significant privacy issues.
Cybersecurity
HIGH
The notifiable privacy-breach regime makes incident response particularly important.
Applicability
The Act applies broadly to New Zealand agencies, including public/private organisations, with specific rules for overseas agencies.
Current validity
CURRENT. Check the consolidation date of the text you rely on.
The official site expressly states that some amendments from 2026 have not yet been incorporated into the 1 May 2026 version. (Legislation New Zealand)
Read first
IPP1–13 → Sections 39–67 → Sections 112–118 → Part 7 information sharing/matching → Sections 192–200.
Provisions / sections covered
IPPs 1–13: Part 3
Cover:
- purpose of collection
- source
- collection method
- retention
- use
- disclosure
- security
- access
- correction
- unique identifiers.
Sections 39–67: Access/correction
Detailed procedures for exercising privacy rights.
Sections 112–118: Notifiable privacy breaches
Section 112 defines a notifiable breach as one reasonably believed to have caused or be likely to cause serious harm. (Legislation New Zealand)
Sections 114–115 establish notification to the Privacy Commissioner and affected individuals/public notice where applicable.
Sections 136–161: Information sharing
Government/agency information-sharing mechanisms.
Sections 174–191: Information matching
Important for automated database matching and government analytics.
Sections 192–200: Overseas transfer restrictions
Part 8 addresses prohibitions concerning onward transfer of personal information received from overseas.
Section 201: Privacy officers
Requires agencies to have privacy-officer arrangements.
Subject-matter tags
- Consent
- Data breach
- Cross-border transfers
- Data protection officer
- Retention
- Enforcement and penalties
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.