New Zealand Privacy Act 2020 privacy statement requirements

Who this law applies to

The Act applies to agencies, a term that covers almost any person or organisation in the public or private sector, with exceptions such as individuals acting in their personal or domestic affairs and news entities carrying out news activities. There is no size or revenue threshold, so sole traders and small online businesses are covered. Overseas agencies are covered for actions taken in the course of carrying on business in New Zealand, regardless of where the information is collected or held, and a business can carry on business in New Zealand without a physical presence there. The Act commenced on December 1, 2020, replacing the Privacy Act 1993. The Privacy Amendment Act 2025 added information privacy principle 3A, in force from May 1, 2026, which applies to personal information collected from sources other than the individual on or after that date. The Office of the Privacy Commissioner oversees the Act.

What your privacy policy must include

IPP3 lists the matters an individual should be aware of when information is collected from them: the fact that it is being collected; the purpose; the intended recipients; the name and address of the agency collecting it and the agency that will hold it; if the collection is authorised or required by law, the particular law and whether providing the information is voluntary or mandatory; the consequences of not providing the requested information; and the rights of access to and correction of the information. IPP3A applies similar duties when information is collected indirectly, requiring the agency to make the individual aware of matters including the agency's name and address, any law authorising or requiring the collection, and their access and correction rights, unless an exception applies. A privacy statement should also describe retention under IPP9, security safeguards under IPP5, and any disclosure overseas, which IPP12 restricts to recipients subject to comparable safeguards or other permitted grounds. IPP6 and IPP7 give people rights to access and correct their information, and access requests must generally be answered within 20 working days.

How Legal Policy Generator handles it

Selecting New Zealand Privacy Act adds a regional clause stating that people are informed of collection purposes, intended recipients, whether providing information is mandatory or voluntary, the consequences of not providing it, and access and correction rights, with the request methods you support and a pointer to the Office of the Privacy Commissioner. When information is collected from providers, partners, or public sources, a second clause states that reasonable steps are taken under IPP3A, unless an exception applies, to make the person aware of the collection, its purposes, the intended recipients, the agency's name and address, any law authorising the collection, and access and correction rights. The notice itself still has to reach people at the time of indirect collection. Because clauses are versioned, a generated policy keeps the clause versions recorded with it, and regeneration creates a new immutable version instead of rewriting the published one. The list below is read from the clause library each time this page is rendered.

Questionnaire answers that switch it on

The New Zealand clause activates only when the jurisdiction answer includes New Zealand Privacy Act. It requires the privacy request methods you actually support. Choosing providers, partners, or public sources in the collection sources answer also activates the IPP3A indirect-collection clause, which names the operator and its address and therefore requires a postal or contact address from individual operators too, and the international processing answers feed the transfers section used for overseas disclosure. In the separate Terms generator, selecting New Zealand adds a clause preserving mandatory New Zealand consumer rights under the Consumer Guarantees Act.

Common mistakes

Relying on a website privacy statement alone when IPP3 expects awareness at or before collection can leave a gap at sign-up forms and app permission prompts. Listing recipients as partners without naming the types of recipients does not tell people who will receive their information. Failing to say whether providing information is voluntary, and what happens if it is not provided, omits two IPP3 items. Sending information to overseas providers without considering IPP12 is a frequent issue for businesses using offshore cloud services. Overlooking IPP3A for information obtained from partners, data brokers, or public sources became a gap on May 1, 2026. Promising a response time shorter than you can meet creates a public commitment beyond the statutory period. Finally, the Act requires notifiable privacy breaches, those that have caused or are likely to cause serious harm, to be reported to the Privacy Commissioner and to affected people, so the security section should be consistent with that duty.

Common questions