New Zealand Regulatory Compliance Services

The Act contains 13 Information Privacy Principles (IPPs) covering matters such as the purpose and method of collection, notification, storage security, access and correction, accuracy, retention, use, disclosure, and unique identifiers.

Organizations may need to establish controls for:

• Identifying appropriate purposes for collecting personal information.
• Providing clear privacy notices and collection information.
• Managing access and correction requests.
• Maintaining appropriate security safeguards.
• Limiting the retention and disclosure of personal information.
• Managing overseas disclosures and information-sharing arrangements.
• Maintaining privacy governance policies and supporting documentation.

An organization must notify the Privacy Commissioner and affected individuals, or provide public notice where applicable, when a privacy breach meets the statutory threshold. The key consideration is whether the breach has caused, or is likely to cause, serious harm.

Organizations should maintain procedures to:

• Identify and assess suspected privacy breaches.
• Determine whether a breach is notifiable.
• Escalate incidents to appropriate decision-makers.
• Notify the Privacy Commissioner and affected individuals where required.
• Document the incident, response, and remediation.
• Review security and governance controls to reduce recurrence.

Information Privacy Principle 12 addresses overseas disclosures and requires organizations to assess whether appropriate protections or other permitted conditions apply before transferring personal information overseas.

Organizations using international cloud providers, offshore support teams, external processors, or overseas business partners should assess the nature of the disclosure, the receiving organization, and the applicable legal conditions.

Businesses operating internationally may also need to consider the GDPR and other foreign privacy laws when their activities fall within those laws' scope.

It is particularly important for healthcare providers, health agencies, and other organizations handling health information within the Code's scope.

Compliance activities may include reviewing collection and disclosure practices, access and correction procedures, security measures, retention, and the use of health information for secondary purposes.

Organizations should determine whether the Code applies to their role and activities rather than assuming that general privacy policies alone address all health information requirements.

The Act generally requires consent for covered commercial electronic messages and includes requirements for sender identification and functional unsubscribe facilities.

Businesses conducting email marketing, SMS campaigns, customer outreach, and automated promotional communications should review:

• How consent is obtained and recorded.
• Whether messages fall within the Act's scope.
• Whether sender information is accurate and sufficient.
• Whether unsubscribe requests are processed appropriately.
• Whether marketing practices align with privacy and consumer protection requirements.

The National Cyber Security Centre (NCSC), part of the Government Communications Security Bureau, provides cybersecurity guidance, threat information, and support for eligible organizations and incidents.

Businesses should assess their exposure to cyber risks, establish incident-response procedures, review third-party security, and determine whether sector-specific notification or resilience requirements apply.

Organizations should not assume that a single cybersecurity law applies identically to every business. Obligations depend on the organization's sector, activities, regulatory status, and applicable legal or contractual requirements.

The Ministry for Regulation published Responsible AI in Action guidance in May 2026, supporting a practical approach to responsible AI use. Guidance should be distinguished from binding statutory requirements.

Organizations using or developing AI should consider privacy, consumer protection, discrimination, intellectual property, confidentiality, and sector-specific obligations.

A proportionate AI governance program may include:

• Maintaining an inventory of AI systems and use cases.
• Assessing risks to individuals and business operations.
• Defining accountability and human oversight.
• Reviewing data quality, privacy, security, and transparency.
• Documenting controls and decisions.
• Monitoring applicable New Zealand and international developments.

The Online Safety (Minimum Age and Child Safety Risk Assessment) Bill was introduced in August 2026. Its proposed requirements should not be treated as enacted obligations unless the relevant legislation has been passed and commenced.

Businesses providing online platforms, digital content, social services, or AI-enabled social experiences should monitor legislative developments and assess applicable existing privacy, consumer protection, content, and other legal requirements.

Examples include:

• GDPR: May apply to New Zealand organizations offering goods or services to individuals in the EU or monitoring their behavior where the GDPR's territorial-scope conditions are met.
• EU AI Act: May apply to relevant AI systems and organizations when its territorial and other scope requirements are satisfied.
• Other international privacy laws: May apply where organizations process personal data in other jurisdictions or serve customers in those markets.