New Zealand's Privacy Act 2020 makes serious privacy breaches a legal reporting obligation, and the Office of the Privacy Commissioner expects to hear about them within 72 hours, yet many organisations still have no agreed way to decide whether a breach has caused, or is likely to cause, serious harm. The Act replaced the Privacy Act 1993 on 1 December 2020 and is built on information privacy principles (IPPs) that apply to almost every agency, public or private. The Privacy Amendment Act 2025 added a new principle, IPP3A, for personal information collected from other sources, which applies from 1 May 2026. This guide explains who the Act covers, the principles that security and engineering teams own, how notifiable breaches work under Part 6, how IPP12 controls overseas disclosure, how the Commissioner enforces, and what it all means for service accounts, API keys and AI agents. It is for security, privacy and engineering leads with New Zealand operations or customers, with status as of October 2026.
Key takeaways
- Serious harm triggers notification. An agency must notify the Privacy Commissioner and affected people as soon as practicable after becoming aware of a privacy breach that has caused or is likely to cause serious harm; OPC guidance asks for notification ideally within 72 hours.
- IPP5 is the security duty. Agencies must use security safeguards that are reasonable in the circumstances against loss, unauthorised access, use, modification or disclosure, and other misuse, and must take every reasonable step to stop service providers misusing the information.
- IPP3A is new from 1 May 2026. Agencies collecting personal information indirectly must take reasonable steps, as soon as reasonably practicable, to tell the individual about the collection, its purpose, the recipients and their rights, unless an exception applies.
- Overseas disclosure needs a basis. IPP12 allows disclosure outside New Zealand only on one of six grounds, such as comparable laws or contractual protections like model clauses.
- Machine identities are where breaches start. Leaked keys, over-scoped service accounts and AI agents with broad data access are IPP5 questions, and the agency answers for its providers as well as itself.
Scope: who and what is covered
The Act regulates agencies: any person or body, in the public or private sector, that collects or holds personal information, with narrow exclusions such as individuals acting in a personal or domestic capacity, news entities carrying on news activities, and the Sovereign, Parliament and the courts in their judicial functions. Personal information is information about an identifiable individual, so customer records, staff files, device identifiers, support tickets and logs can all qualify.
| Who or what | Position under the Act | Practical note for security teams |
|---|---|---|
| New Zealand agencies, public and private | Fully covered by the IPPs and Part 6 | Includes small businesses, charities and government departments |
| Overseas agencies carrying on business in New Zealand | Covered for information collected or held in the course of that business, even without a physical presence (section 4) | Offshore SaaS and platforms serving New Zealand users |
| Service providers holding information for an agency | Information held as an agent for another agency is treated as held by that agency (section 11) | Cloud and outsourced processing is not a disclosure, but the principal stays accountable |
| Information sent overseas to a separate agency | IPP12 applies to the disclosure | Resellers, partners, group companies acting for their own purposes |
| Codes of practice | Modify the IPPs for sectors (for example health, credit reporting, telecommunications) | Several codes gained a new rule 3A alongside IPP3A |
The Act has 13 principles. IPP3A was inserted after IPP3, so the OPC still presents the set as principles 1 to 13 with 3A added.
Key obligations
| Principle | What it requires | Security and engineering evidence |
|---|---|---|
| IPP1 Purpose of collection | Collect only for a lawful purpose connected with the agency's functions, and only what is necessary | Data minimisation reviews for new forms, APIs and telemetry |
| IPP2 Source of information | Collect directly from the individual unless an exception applies | Records of indirect sources such as data brokers and partners |
| IPP3 What to tell the individual (direct collection) | Tell people about collection, purpose, recipients and rights | Privacy notices tied to collection points |
| IPP3A What to tell the individual (indirect collection) | Reasonable steps to tell the individual about collection from another source, its purpose, recipients, the collecting and holding agencies, any authorising law and their access and correction rights | Notification workflow for imported, enriched and scraped data |
| IPP4 Manner of collection | Lawful, fair and not unreasonably intrusive, with care for children and young people | Reviews of tracking and monitoring tools |
| IPP5 Storage and security | Reasonable safeguards against loss, unauthorised access, use, modification or disclosure and other misuse; prevent service provider misuse | MFA, access control, encryption, logging, vendor security terms |
| IPP6 and IPP7 Access and correction | Individuals can access and request correction of their information | Ability to find a person's data across systems, logs and AI tools |
| IPP8 Accuracy | Check accuracy before use | Data quality controls in source systems |
| IPP9 Retention | Keep no longer than required for the lawful purpose | Retention schedules, deletion jobs, backup expiry |
| IPP10 and IPP11 Use and disclosure | Use and disclose only for the collection purpose, a directly related purpose, with authorisation or under a listed exception | Purpose tags on datasets, sharing approvals |
| IPP12 Disclosure outside New Zealand | Only on one of six grounds | Transfer register, contract clauses |
| IPP13 Unique identifiers | Limits on assigning and using unique identifiers | Avoid reusing government identifiers as internal keys |
IPP5 in practice
"Reasonable in the circumstances" scales with sensitivity, volume and the harm a breach would cause. In technical terms that means:
- Access control: least privilege and periodic review for every human and non-human identity that reaches personal data (NIST CSF 2.0 PR.AA-05, SP 800-53 AC-6). See the Access Reviews Guide.
- Authentication: MFA for remote and administrative access, and managed, rotated credentials for services (SP 800-53 IA-5).
- Data protection: encryption at rest and in transit (PR.DS-01, PR.DS-02; SC-28, SC-8).
- Service providers: IPP5(b) requires every reasonable step to stop a provider using or disclosing the information without authority, so contracts need security, breach notice, sub-processor and deletion terms (SA-9).
- Monitoring: logging of access and bulk reads so a breach can be scoped quickly enough to meet the notification expectation (AU-2, DE.CM-03).
Notifiable privacy breaches (Part 6)
A privacy breach is unauthorised or accidental access to, or disclosure, alteration, loss or destruction of, personal information, or an action that prevents the agency accessing it, such as ransomware encryption. It becomes notifiable when it is reasonable to believe it has caused or is likely to cause serious harm (section 112). The OPC points agencies to these factors when assessing harm:
- Sensitivity: some information types, such as health, financial and identity documents, are more likely to cause serious harm.
- Who was affected: vulnerable people, such as victims of family violence, may face greater risk.
- Types of harm: physical harm, financial fraud, identity theft, psychological or emotional harm, employment harm, blackmail and risk to life.
- Who has the information and control: whether the agency still controls it and what mitigation is in place.
- Cultural perspectives: how the affected people themselves view the harm.
| Step | Requirement or expectation | Source |
|---|---|---|
| Assess | Decide whether the breach is notifiable; the OPC self-assessment tool is a guide, the agency owns the decision | Sections 112 to 117; OPC NotifyUs |
| Notify the Commissioner | As soon as practicable after becoming aware; OPC asks for notice ideally within 72 hours, even while investigating | Section 114; OPC guidance |
| Notify affected individuals | As soon as practicable, or a public notice where individual notice is not reasonably practicable | Sections 115 and 116 |
| Exceptions and delay | Limited exceptions and delays, for example where notice would endanger safety or prejudice security | Section 116 |
| Follow-up information | Information not available at first notice may be provided later, as soon as practicable | Section 117; OPC NotifyUs |
| Failure to notify the Commissioner | Offence with a fine of up to NZ$10,000 | Section 118 |
Notification is made through the OPC's NotifyUs tool. The form asks for the breach and discovery dates, number of people affected, type of information, cause, where the information may have gone, likely harm, mitigation, security measures, whether affected people were told, and other organisations notified, such as CERT NZ, IDCARE or Netsafe. If imminent harm is suspected, call Police on 111 first. For other jurisdictions' clocks, see the Breach Notification Laws by Country Guide.
Overseas disclosure (IPP12)
IPP12 applies when an agency discloses personal information to a foreign person or entity under certain IPP11 grounds. The disclosure is allowed only if one of these applies:
- The individual authorises it after being expressly told the recipient may not be required to protect the information comparably.
- The recipient carries on business in New Zealand and the agency reasonably believes it is subject to the Act.
- The agency reasonably believes the recipient is subject to privacy laws with comparable safeguards overall.
- The recipient participates in a prescribed binding scheme (regulations under section 213).
- The recipient is subject to the laws of a prescribed country (regulations under section 214).
- The agency otherwise reasonably believes the recipient must protect the information comparably, for example under an agreement using model contract clauses.
Where a cloud or SaaS provider only stores or processes information on the agency's behalf, section 11 treats it as an agent, so IPP12 does not apply, but IPP5 still does. New Zealand is on the European Commission's adequacy list, which eases inbound EU transfers. See the International Data Transfers Map.
Timeline and current status
| Date | Event | Status as of October 2026 |
|---|---|---|
| 1 December 2020 | Privacy Act 2020 in force, replacing the Privacy Act 1993, with mandatory breach notification, compliance notices and IPP12 | In force |
| 2025 | Privacy Amendment Act 2025 passed, adding IPP3A on indirect collection | Enacted |
| 1 May 2026 | IPP3A applies; several codes of practice gain a rule 3A | In force |
| Ongoing | OPC updating its guidance and website for IPP3A | In progress; no IPP3A case notes yet |
Confirm the current consolidated text on the New Zealand Legislation website before relying on section numbers.
Enforcement and penalties
New Zealand uses complaints, investigations, directions and tribunal remedies rather than large administrative fines.
| Tool | What it does | Practical effect |
|---|---|---|
| Complaints and investigations | The Commissioner investigates complaints about interferences with privacy and can start inquiries | Outcomes are published as case notes |
| Compliance notices | The Commissioner can require an agency to do something, or stop doing something, to comply with the Act | Public, enforceable, can be appealed to the Human Rights Review Tribunal |
| Access directions | The Commissioner can direct an agency to give an individual access to their information | Removes delay on IPP6 disputes |
| Human Rights Review Tribunal | Can award damages, including for humiliation, loss of dignity and injury to feelings, and make orders | The main financial exposure for agencies |
| Offences | Fines of up to NZ$10,000, for example failing to notify a notifiable breach, misleading an agency to obtain information, or destroying requested information | Low fines, but convictions and publicity follow |
The reputational effect of a named OPC inquiry or compliance notice usually outweighs the fine. Plan for scrutiny of how quickly the breach was assessed and whether IPP5 safeguards were reasonable.
What it means for AI agents and non-human identities
- Every service identity is an IPP5 safeguard: inventory the service accounts, API keys, OAuth apps and agents that read personal data, assign owners, scope them and rotate their secrets. See the Non-Human Identity (NHI) Guide and the Secrets Management Guide.
- A leaked key is a breach assessment: if an exposed credential could reach personal data, run the serious harm assessment, not just the rotation. Log evidence of what the key actually accessed.
- AI providers are agents or recipients: a hosted model that only processes on your behalf sits under section 11 and IPP5; one that uses prompts for its own purposes is a disclosure under IPP11 and possibly IPP12.
- IPP3A reaches data enrichment: agents that gather personal information from websites, partners or other systems are collecting indirectly, so the IPP3A notice duty and its exceptions need assessing per use case.
- Access requests include agent records: IPP6 requests may cover prompts, transcripts and agent action logs. See the AI Agent Audit Trails for Regulators Guide and the AI and Privacy Guide.
Compliance steps
- Map information and identities: list systems holding New Zealand personal information, their purpose, retention and every human and non-human identity with access. Start with identity documents, health and financial data.
- Close IPP5 gaps: MFA, least privilege, encryption, patching and centralised access logging on personal data stores.
- Build the serious harm decision: a short documented assessment using the OPC factors, a named decision maker, and a target of NotifyUs submission within 72 hours of awareness. Pilot it with tabletop exercises, including a ransomware loss-of-access case and a leaked API key case. See the Incident Response Plan Template.
- Fix provider contracts: security standards, breach notice within hours, sub-processor control, deletion at exit.
- Register overseas disclosures: record each IPP12 ground relied on, and add model clauses where comparable law cannot be shown.
- Implement IPP3A: list indirect collection sources, decide which exception applies or build the notice, and update code of practice rule 3A obligations where a code applies.
- Measure and review: report the metrics below quarterly and re-test the breach process after major system changes. Roll back any data feed whose IPP3A or IPP12 basis cannot be documented until it can.
Small versus large organisations
A small agency can meet the Act with a data list, MFA, a standard supplier clause and a one-page breach decision sheet linked to NotifyUs. A group operating across Australia and New Zealand should run one incident process with jurisdiction-specific decision points, because the Australian assessment period and New Zealand's as-soon-as-practicable test differ. See the Australian Privacy and Cyber Rules Guide.
Detection, measurement and framework mapping
- Coverage: percentage of personal data stores with an owner and complete access logging.
- Machine identity hygiene: percentage of non-human identities with personal data access that have an owner and in-policy rotation.
- Breach decision time: hours from awareness to a recorded serious harm decision, and to NotifyUs submission.
- Provider coverage: percentage of service providers with security and breach notice clauses.
- Overseas register completeness: percentage of overseas disclosures with a recorded IPP12 ground.
| Privacy Act requirement | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Understand legal obligations | GV.OC-03 | PT-2 | A.5.31, A.5.34 |
| IPP5 access and authentication | PR.AA-05 | AC-6, IA-5 | A.5.15, A.5.18, A.8.5 |
| IPP5 data protection | PR.DS-01, PR.DS-02 | SC-8, SC-28 | A.8.24 |
| IPP5(b) service providers | GV.SC-05 | SA-9 | A.5.19, A.5.20 |
| IPP9 retention | PR.DS-01 | SI-12 | A.8.10 |
| Part 6 notification | RS.CO-02 | IR-6 | A.5.24, A.5.26 |
Common failure patterns
- Waiting for the investigation to finish: the OPC asks for notice even while investigating; holding off until scope is certain misses the expectation.
- Ignoring loss of access: ransomware that encrypts records without exfiltration is still a privacy breach and may be notifiable.
- Treating every vendor as an agent: providers that use data for their own purposes are recipients, which brings IPP11 and IPP12 into play.
- Orphaned machine credentials: integration keys with broad read access and no owner are a common root cause and slow the harm assessment.
- Forgetting IPP3A for bought or scraped data: enrichment feeds set up before May 2026 may now need notices or a documented exception.
Practitioner checklist
- Inventory systems holding New Zealand personal information, with purpose, retention and owner.
- Review every non-human identity with access to those systems and remove what is not needed.
- Enforce MFA, encryption and access logging on personal data stores.
- Adopt a documented serious harm assessment and a 72-hour NotifyUs target.
- Add security, breach notice and deletion terms to every service provider contract, AI tools included.
- Record the IPP12 ground for each overseas disclosure.
- List indirect collection sources and implement IPP3A notices or exceptions.
- Exercise the breach process yearly with a ransomware and a leaked key scenario.
Standards and references
- Office of the Privacy Commissioner: Privacy principles
- Office of the Privacy Commissioner: Principle 5, storage and security
- Office of the Privacy Commissioner: Principle 3A, indirect collection
- Office of the Privacy Commissioner: Principle 12, disclosure outside New Zealand
- Office of the Privacy Commissioner: Privacy breaches
- Office of the Privacy Commissioner: NotifyUs
- Office of the Privacy Commissioner: Privacy Act 2020
Related NHI Mgmt Group resources: Global Privacy Regulatory Map · Australian Privacy and Cyber Rules Guide · Breach Notification Laws by Country Guide · International Data Transfers Map · Hong Kong PDPO Guide. This guide summarises the New Zealand Privacy Act 2020, as amended by the Privacy Amendment Act 2025, and Office of the Privacy Commissioner guidance as of October 2026 and is not legal advice.