Don’t do SECURITY. Do business SECURELY.
Threat intelInsightsBook a consultation
Back to all insights

New Zealand’s Privacy Act 2020 comes into force

New Zealand’s Privacy Act 2020 introduces mandatory breach notification and new rules for overseas organisations.

New Zealand’s Privacy Act 2020 comes into force today, replacing the Privacy Act 1993.

Key points

  • Notifiable privacy breaches must be reported to the Privacy Commissioner and affected individuals.
  • Overseas agencies carrying on business in New Zealand are covered.
  • IPP12 restricts cross-border disclosure.
  • The Commissioner can issue compliance notices.

UK organisations carrying on business in New Zealand need to meet breach notification and cross-border disclosure requirements. The Act also introduced criminal offences, including destroying requested information. New Zealand’s EU adequacy status supports data flows with Europe and the UK, but organisations must still assess comparable safeguards before disclosing information overseas.

Source: Privacy Act 2020 (New Zealand Legislation)

Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.

Get our weekly insights by emailA free weekly threat and vulnerability round-up with a link to our threat log spreadsheet, plus legal, regulatory, standards, and AI updates.
Subscribe free

How we can help: consulting, auditing, and AI governance. Book a complimentary consultation.

More insights