Updated 5 October 2026 · Includes IPP 3A and the Biometric Code

Privacy Act 2020 (NZ): The Complete 2026 Guide for New Zealand Businesses and Marketers

Table of Contents

The Privacy Act 2020 is New Zealand’s main privacy law. It sets 14 information privacy principles (IPPs) for how every business, charity and government agency collects, stores, uses and shares personal information, makes serious privacy breaches notifiable, and is enforced by the Office of the Privacy Commissioner.

This guide explains the Act in plain English, including IPP 3A (in force from 1 May 2026), the Biometric Processing Privacy Code 2025, what the law means for cookies, pixels, email and AI, and how to use an offshore marketing provider without breaching IPP 12.

By Chenna Reddy, Founder, Digital Masters 360 · Reviewed for New Zealand readers · 16 min read

The Privacy Act 2020 in 50 Words

The Privacy Act 2020 is New Zealand's privacy law. It applies to almost every organisation that handles personal information, including small businesses and overseas companies doing business in New Zealand. It sets 14 privacy principles, requires notification of serious breaches, and is enforced by the Privacy Commissioner.

Key takeaways

Commenced 1 December 2020, replacing the Privacy Act 1993 (Public Act 2020 No 31).
14 principles: the original 13 IPPs in section 22, plus IPP 3A (notice of indirect collection) from 1 May 2026.
No small-business exemption. A sole trader is covered the same way a bank is.
Overseas businesses are covered if they carry on business in New Zealand (section 4), even with no office here.
Notifiable breaches: a breach likely to cause serious harm must be reported to the Commissioner and affected people as soon as practicable.
Enforcement today is mostly reputational and remedial: compliance notices, Tribunal damages and fines up to NZ$10,000 for offences. A civil penalty regime is being consulted on but is not law.
Marketers: pixels, bought lists, data enrichment and AI tools are all caught when people can be identified. Email and SMS also fall under the Unsolicited Electronic Messages Act 2007.

In this guide

What Is the Privacy Act 2020?

The Privacy Act 2020 is the New Zealand statute that governs personal information. It received Royal assent on 30 June 2020 and commenced on 1 December 2020, replacing the Privacy Act 1993. Its purpose is to promote and protect individual privacy while recognising that other rights and interests, such as the free flow of information, also matter, and to give effect to New Zealand’s international obligations.

Where the law sits

The Act sits at three levels, and it helps to know which one you are reading:

The Act itself (Privacy Act 2020, Public Act 2020 No 31): definitions, the Commissioner’s powers, complaints, access requests, breach notification and offences.
The information privacy principles in section 22: the day-to-day rules for collecting, holding, using and disclosing personal information. IPP 3A was inserted by the Privacy Amendment Act 2025.
Codes of practice issued by the Commissioner, which replace or modify the IPPs for particular sectors or technologies: the Health Information Privacy Code 2020, the Credit Reporting Privacy Code 2020, the Telecommunications Information Privacy Code 2020, the Civil Defence National Emergencies (Information Sharing) Code 2020 and the Biometric Processing Privacy Code 2025.

What changed from the Privacy Act 1993

Topic	Privacy Act 1993	Privacy Act 2020
Breach notification	Voluntary	Mandatory for notifiable privacy breaches (serious harm)
Overseas businesses	Unclear reach	Expressly covered if carrying on business in NZ (s 4)
Sending data overseas	No specific principle	IPP 12 cross-border disclosure rules
Commissioner's powers	Mostly investigate and refer	Compliance notices and binding access directions
Maximum fine for offences	NZ$2,000	NZ$10,000
Collecting from children	No specific rule	IPP 4: take particular care with children and young people
Indirect collection notice	None	IPP 3A, from 1 May 2026 (added in 2025)

Who enforces the Privacy Act 2020?

Office of the Privacy Commissioner (OPC), Te Mana Mātāpono Matatapu: receives complaints and breach notifications, investigates, issues compliance notices and access directions, approves codes and publishes guidance. Michael Webster has been Privacy Commissioner since July 2022.
Human Rights Review Tribunal (HRRT): hears privacy proceedings after an OPC complaint and can award damages, make declarations and order an agency to act.
District Court: hears prosecutions for offences under the Act and appeals against compliance notices.
Department of Internal Affairs (DIA): enforces the Unsolicited Electronic Messages Act 2007 (spam rules), which sits alongside the Privacy Act for email and SMS marketing.

Key definitions you need

Personal information

Personal information is information about an identifiable individual. It does not need a name: an email address, phone number, IP address linked to an account, device ID, purchase history, photo, voice recording or location trail can all be personal information if someone can reasonably be identified from it, alone or combined with other data. Information about a death recorded under the Births, Deaths, Marriages, and Relationships Registration Act is excluded.

Agency

An agency is any person or organisation, in the public or private sector, that collects or holds personal information. That includes companies, sole traders, partnerships, charities, clubs, schools and government departments. The main exclusions are individuals acting in a purely personal or household capacity, the news activities of news entities, Parliament and the courts in their judicial functions.

Privacy breach and notifiable privacy breach

A privacy breach is unauthorised or accidental access to, or disclosure, alteration, loss or destruction of, personal information, or anything that stops an agency accessing it. It becomes a notifiable privacy breach when it is reasonable to believe it has caused, or is likely to cause, serious harm to an affected individual.

The serious-harm factors (section 113)

Section 113 lists what you must weigh when deciding whether harm is serious:

any action taken to reduce the risk of harm (for example, recovering a lost laptop before it was opened);
whether the information is sensitive in nature (health, financial, identity documents, location);
the nature of the harm that may be caused (financial loss, identity theft, humiliation, physical risk);
the person or body that obtained or may obtain the information;
whether the information is protected by a security measure such as strong encryption;
any other relevant matters.

Tip: document every assessment

Tip

Keep a written breach register that records every incident, your serious-harm assessment and the reasons for your decision, even when you decide not to notify. If the Commissioner later asks, a documented decision is far easier to defend.

The 14 Information Privacy Principles at a Glance

The Act is often described as having 13 principles. Since 1 May 2026 there are 14: IPP 1 to IPP 13, plus IPP 3A. Most of the principles have exceptions, so read the full principle in section 22 before relying on one.

Information privacy principles, Privacy Act 2020, section 22 (as amended 2025)
IPP	Name	What it means in practice
1	Purpose of collection	Only collect personal information you need for a lawful purpose connected with your business.
2	Source	Collect it from the person directly unless an exception applies.
3	Collection from the individual	Tell people what you collect, why, who gets it and their rights, at or before collection.
3A	Collection from another source (new, 1 May 2026)	If you get someone's information from a third party, tell them, unless an exception applies.
4	Manner of collection	Collect lawfully and fairly, without unreasonable intrusion. Take particular care with children and young people.
5	Storage and security	Protect information with reasonable safeguards against loss, misuse and unauthorised access.
6	Access	People can ask for the information you hold about them.
7	Correction	People can ask you to correct it, or attach a statement if you refuse.
8	Accuracy	Check information is accurate, up to date, complete and not misleading before you use or disclose it.
9	Retention	Do not keep it longer than you need it.
10	Limits on use	Use it only for the purpose you collected it for, unless an exception applies.
11	Limits on disclosure	Do not disclose it to others unless an exception applies.
12	Cross-border disclosure	Only send it to a foreign person or entity if it will be protected by comparable safeguards.
13	Unique identifiers	Do not assign or reuse someone's unique identifier (e.g. IRD or driver licence number) unless necessary.

Each Privacy Principle Explained, With Examples

Collecting personal information (IPPs 1 to 4)

IPP 1: Purpose of collection

You may only collect personal information for a lawful purpose connected with your functions or activities, and only if collecting it is necessary for that purpose. If you do not need an identifying detail, do not collect it. For marketers, this is the principle that challenges long lead forms: asking for date of birth, job title and phone number on a newsletter sign-up is hard to justify.

IPP 2: Source of personal information

Collect information directly from the person concerned. Exceptions include where the information is publicly available, the person authorises collection from someone else, collecting directly would prejudice the purpose, or it is not reasonably practicable. IPP 2 decides whether you may collect indirectly; IPP 3A now decides whether you must tell the person you did.

IPP 3: Collection of information from the individual

When you collect from the person, take reasonable steps to make them aware, before or as soon as practicable after collection, of: the fact you are collecting it; the purpose; the intended recipients; your name and address and that of any agency holding it; any law requiring it and whether supplying it is voluntary; the consequences of not supplying it; and their rights to access and correct it. In practice this is your privacy statement, collection notice on forms, and the wording beside opt-in boxes.

IPP 3A: Collection from another source (new from 1 May 2026)

IPP 3A was inserted by the Privacy Amendment Act 2025 and took effect on 1 May 2026. If you collect personal information about someone from a source other than that person, you must take reasonable steps to make them aware of the collection and its key details as soon as reasonably practicable. The change closes a gap identified during the European Union’s review of New Zealand’s adequacy status.

What an IPP 3A notice should cover

The notice mirrors IPP 3. Tell the person:

that you have collected their information, and what it is;
why you collected it and who you intend to share it with;
your name and address, and those of any agency holding the information for you;
any law that authorises or requires the collection; and
their rights to access and correct the information.

When you do not have to notify

You do not have to notify where, for example:

the person has already been made aware of these matters (for instance, the original source told them it would share with you);
the information is publicly available;
notifying would prejudice the interests of the person, the maintenance of the law or the purpose of collection;
notifying is not reasonably practicable in the circumstances; or
the information will be used in a form that does not identify the person, or for statistical or research purposes without identifying them.

Check the exact wording of each exception in section 22 and the OPC’s IPP 3A guidance, and keep a record whenever you rely on one.

Marketing watch-out: lists, partners and enrichment

Watch-out

Marketing watch-out: bought or rented lists, referral partners, data enrichment tools (that append job titles, company size or social profiles to a lead), lookalike data from platforms, event attendee lists and lead-generation vendors are all indirect collection. Since 1 May 2026, you either rely on a documented exception or you notify, usually in your first email or within a short time of import.

IPP 4: Manner of collection

Collect information lawfully, fairly and without unreasonably intruding on the person’s affairs. The 2020 Act added an express duty to take particular care when collecting from children and young people. Dark patterns, pre-ticked boxes, hidden tracking and quizzes designed to harvest data from teenagers are all IPP 4 risks.

Keeping it safe (IPP 5)

IPP 5: Storage and security

Protect personal information with security safeguards that are reasonable in the circumstances against loss, unauthorised access, use, modification or disclosure and other misuse. If you give information to a service provider (a cloud host, a CRM, an agency), you must do everything reasonably within your power to stop unauthorised use or disclosure. Reasonable today means multi-factor authentication on every account, named-user access rather than shared logins, encryption, prompt removal of leavers and tested backups.

Access, correction and accuracy (IPPs 6 to 8)

IPP 6: Access to personal information

An individual is entitled to confirmation of whether you hold readily retrievable information about them, and to access it. IPP 6(1) is the one principle that is a legal right enforceable in court against public sector agencies; for private businesses it is enforced through OPC complaints and the Tribunal. You can refuse only on the grounds listed in sections 49 to 53 (for example, where disclosure would unreasonably disclose someone else’s information).

IPP 7: Correction of personal information

People can ask you to correct information. If you decline, you must take reasonable steps to attach their statement of the correction sought, so anyone who later sees the record sees their view.

IPP 8: Accuracy

Before using or disclosing information, take reasonable steps to check it is accurate, up to date, complete, relevant and not misleading. Stale CRM data used for decisions (credit, eligibility, pricing) is an IPP 8 risk.

The 20 working day rule

Deadline

You must respond to an access or correction request as soon as reasonably practicable and no later than 20 working days after receiving it, though you can extend the time limit in specified circumstances by telling the person. Private sector agencies may charge a reasonable fee in limited cases; public sector agencies generally cannot.

Retention, use and disclosure (IPPs 9 to 11)

IPP 9: Retention

Do not keep personal information for longer than is required for the purposes for which it may lawfully be used. Set retention periods per data type (leads, customers, job applicants, call recordings) and actually delete or de-identify when they expire.

IPP 10: Limits on use

Information collected for one purpose must not be used for another, unless an exception applies: the new purpose is directly related, the person authorised it, the information is publicly available, it is used in a non-identifying form, or it is necessary to prevent a serious threat or to uphold the law. Using support-ticket data to build an ad audience is a classic IPP 10 problem.

IPP 11: Limits on disclosure

You must not disclose personal information to another person or agency unless you believe on reasonable grounds that an exception applies, such as the disclosure being one of the purposes for which it was obtained, the person authorising it, or disclosure being necessary to avoid prejudice to the maintenance of the law or to prevent a serious threat. Uploading a customer list to an ad platform is a disclosure.

Overseas disclosure and identifiers (IPPs 12 and 13)

IPP 12: Disclosure outside New Zealand

You may only disclose personal information to a foreign person or entity if one of the following applies:

The six permitted grounds

the person authorises the disclosure after being expressly informed that the recipient may not be required to protect it in a way comparable to the Act;
the recipient is carrying on business in New Zealand and you believe it is subject to the Act;
the recipient is subject to privacy laws that provide comparable safeguards;
the recipient is a participant in a prescribed binding scheme;
the recipient is subject to the privacy laws of a prescribed country; or
you otherwise believe on reasonable grounds the recipient is required to protect it with comparable safeguards, for example under a contract using the OPC’s model contract clauses.

IPP 12 does not apply where the overseas party is acting as your agent under section 11 (for example a cloud host or processor that only uses the data on your behalf). In that case you remain responsible for what it does with the data.

IPP 13: Unique identifiers

Only assign a unique identifier (such as a customer number) if it is necessary for your functions, and do not adopt an identifier another agency assigned (for example an IRD number, driver licence number or passport number) as your own. Take reasonable steps to verify identity before assigning one and to reduce the risk of misuse.

Who Must Comply With the Privacy Act 2020?

Is there a small-business exemption?

Unlike Australia’s Privacy Act 1988, which generally exempts businesses with annual turnover of A$3 million or less, New Zealand has no small-business exemption. A café with a loyalty list, a tradie with a customer spreadsheet and a Shopify store with 200 orders all have the same core duties as a large retailer. What changes with size is what counts as reasonable, not whether the Act applies.

Overseas businesses: section 4

Under section 4, the Act applies to an overseas agency in relation to any action taken in the course of carrying on business in New Zealand, wherever the information is collected or held and wherever the person concerned lives. You can carry on business in New Zealand without a physical presence, a New Zealand company or making a profit here. A US SaaS company, an Australian e-commerce brand or an Indian agency selling to New Zealand customers can all be covered.

Service providers and agents: section 11

If you give information to another agency that holds it solely as your agent, for example for safe custody or processing, and that agent does not use or disclose it for its own purposes, the information is treated as held by you. You stay responsible for its handling; the agent’s actions are treated as yours. This is the structure most privacy-careful outsourcing relationships, including offshore marketing agencies, should use.

Quick test: does the Act apply to you?

Question	If yes	If no
Do you collect or hold information about identifiable people?	Continue below	The Act's principles do not bite
Are you in New Zealand, or carrying on business in New Zealand?	The Act applies (no turnover threshold)	Check the law where you are
Is the information only for personal or household affairs?	Generally exempt	Covered
Do you process health, credit, telecommunications or biometric information?	Also follow the relevant code of practice	The IPPs apply as written
Do you send information to a provider outside New Zealand?	Check section 11 (agent) or IPP 12 grounds	IPP 11 still governs local disclosure

The Privacy Act 2020 for Marketers

Most privacy guides are written for lawyers or IT teams. This section is for the people who run websites, ads, email and CRM, because that is where most everyday personal information is collected.

Cookies, pixels and analytics

New Zealand has no separate cookie statute, so the Privacy Act does the work whenever tracking produces information about identifiable people. A Meta Pixel, TikTok Pixel, LinkedIn Insight Tag or GA4 setup that sends hashed emails, phone numbers, user IDs or form contents to a platform is collecting (IPPs 1 to 4) and disclosing (IPPs 11 and 12) personal information.

Say plainly in your privacy statement which tags you use, what they send and to whom (IPP 3).
Do not let pixels fire on pages that capture health, financial or children’s information, or pass form field contents in URLs.
Prefer server-side tagging with field allow-lists, and turn off automatic advanced matching unless you have assessed it.
Use a consent banner as good practice, especially if you also market to the EU or UK, where consent is a legal requirement.

Email and SMS marketing: two laws, not one

Rule	Privacy Act 2020	Unsolicited Electronic Messages Act 2007
Who enforces	Privacy Commissioner	Department of Internal Affairs (DIA)
What it covers	Collecting and using the contact details	Sending commercial email, SMS and instant messages
Consent	Tell people the purpose at collection (IPP 3); use only for that purpose (IPP 10)	Express, inferred or deemed consent required before sending
Identify yourself	Name and address in collection notice	Accurate sender information in every message
Opt-out	Stop using data for purposes the person objects to; respect correction requests	A functional unsubscribe in every message, honoured within 5 working days
Bought lists	IPP 2 and new IPP 3A notification	Consent does not transfer by purchase

CRM, enrichment and custom audiences

Before uploading a customer list to Meta, Google or LinkedIn for matching or lookalike audiences, check that your collection notice told people their details could be shared with advertising platforms (IPP 3 and IPP 11), that the platform’s processing location is covered under IPP 12, and that you exclude people who opted out. Enrichment tools that add data from other sources now trigger IPP 3A.

AI tools and generative AI

The Commissioner expects agencies to apply the IPPs to artificial intelligence, including generative AI. Before pasting customer data into an AI tool: check whether the vendor uses inputs for training, whether data leaves New Zealand (IPP 12), whether outputs about people could be inaccurate (IPP 8), and whether people were told (IPP 3). Do a privacy impact assessment for any AI that makes or supports decisions about individuals. The Commissioner has also recommended that the law should require transparency about automated decision-making.

Biometrics: the Biometric Processing Privacy Code 2025

The Biometric Processing Privacy Code 2025 applies to agencies that use technology to collect and process biometric information to verify, identify or categorise people, such as facial recognition, fingerprint, voice or gait analysis. New processing had to comply from 3 November 2025 and processing already under way from 3 August 2026. You must assess whether processing is necessary, effective and proportionate (including the cultural impacts on Māori), give enhanced notice, and avoid restricted categorisation, such as inferring emotions, health or personality, except in narrow cases. A gym door scanner, retail facial recognition or voice ID on a call line are all in scope.

Marketer's compliance checklist

Area	Action	Principle
Forms	Remove fields you do not need; add a short collection notice	IPP 1, IPP 3
Third-party data	List every indirect source; notify or document the exception	IPP 2, IPP 3A
Pixels and tags	Audit what each tag sends; block on sensitive pages	IPP 4, IPP 11, IPP 12
Email and SMS	Record consent type and date; working unsubscribe	IPP 10, UEM Act
Ad audiences	Disclose sharing with platforms; exclude opt-outs	IPP 3, IPP 11
Vendors	Section 11 agreement or IPP 12 safeguards for each provider	IPP 5, IPP 12
Retention	Delete stale leads on a schedule	IPP 9
AI tools	Privacy impact assessment; no customer data in training	IPP 1, IPP 5, IPP 8

Privacy Breaches and Mandatory Notification

Part 6 of the Act made breach notification mandatory for the first time in New Zealand. Here is the process the OPC expects.

Step	What to do	Timing
1. Contain	Revoke access, reset credentials, recall emails, isolate systems	Immediately
2. Assess	Work out what information, whose, how sensitive, and the likely harm (s 113 factors)	Within hours
3. Notify the Commissioner	If serious harm is likely, notify via the OPC's online NotifyUs tool	As soon as practicable (OPC expects within 72 hours of becoming aware)
4. Notify affected people	Tell them what happened, what you are doing and what they can do; a public notice is allowed if direct notice is not practicable	As soon as practicable
5. Review	Fix root causes, update your register, train staff	Within weeks

Using NotifyUs and what happens next

Failing to notify the Commissioner of a notifiable privacy breach without reasonable excuse is an offence with a fine of up to NZ$10,000. Limited delays and exceptions apply (for example where notifying an individual would endanger someone’s safety), and you must record why you relied on them. The OPC has reported sharp year-on-year increases in serious breach notifications, so the regulator is seeing more of them, not fewer.

Penalties and Enforcement Under the Privacy Act 2020

New Zealand’s fines are small next to Australia or Europe, but enforcement is not toothless: compliance notices are binding, Tribunal damages can be significant, and public naming affects trust. The Commissioner has publicly called for much larger civil penalties.

Tool	Who uses it	What it means
Investigation and naming	Privacy Commissioner	Reputational damage; the OPC can publish the outcome and name agencies in some cases
Compliance notice	Privacy Commissioner	A binding order to do or stop doing something; enforceable through the Tribunal
Access direction	Privacy Commissioner	A binding order to give someone their information
Damages and orders	Human Rights Review Tribunal	Compensation for loss, humiliation and injury to feelings, plus declarations and orders
Criminal fine	District Court	Up to NZ$10,000 per offence, e.g. failing to notify a breach, misleading an agency to get someone's information, destroying requested information, ignoring a compliance notice
Civil pecuniary penalties	Proposed only	Floated in the Government's 2026 cyber security plan and backed by the Commissioner; not law as at October 2026

Privacy Act 2020 Changes and Reforms, 2020 to 2026

Date	Change	What to do
1 Dec 2020	Privacy Act 2020 commences, replacing the 1993 Act	Baseline compliance
Dec 2020	Four codes of practice reissued (health, credit, telecommunications, civil defence)	Follow your sector code
Jan 2024	European Commission confirms NZ's continued EU adequacy, with a request to address indirect collection	Explains why IPP 3A followed
Sept 2025	Privacy Amendment Act 2025 passed, inserting IPP 3A	Map indirect sources
3 Nov 2025	Biometric Processing Privacy Code 2025 applies to new biometric processing	Proportionality assessment
2025	Commissioner's five-year review calls for civil penalties, a right to erasure, automated decision-making transparency and demonstrable compliance	Watch for a Bill
2026	Cyber Security Strategy 2026–2030 and Action Plan propose a civil penalty regime under the Privacy Act (consultation)	Budget for stronger enforcement
1 May 2026	IPP 3A in force	Notify or document exceptions
3 Aug 2026	Biometric Code applies to existing biometric processing	Remediate legacy systems
2026	OPC consults on amendments to codes of practice	Check your sector code

Status check

Reform proposals (civil penalties, a right to erasure, automated decision-making transparency) are not law as at October 2026. Check the OPC and Ministry of Justice for the current status before relying on this table.

Privacy Act 2020 vs GDPR, UK GDPR, Australia and CCPA

If you sell into several Tier 1 markets, these are the differences that matter in practice.

Feature	NZ Privacy Act 2020	EU GDPR	UK GDPR	Australia Privacy Act 1988	California CCPA/CPRA
Core rules	14 IPPs	7 principles + lawful bases	Same as GDPR	13 APPs	Consumer rights + notices
Small business	Covered	Covered	Covered	Mostly exempt under A$3m turnover	Thresholds apply
Lawful basis needed	No (purpose-based)	Yes	Yes	No (purpose-based)	No
Breach notice	Serious harm, as soon as practicable	72 hours to regulator	72 hours to ICO	Serious harm, within 30 days to assess	Under separate breach law
Overseas transfers	IPP 12	Adequacy, SCCs	Adequacy, IDTA	APP 8	Contract terms
Right to erasure	No (only correction)	Yes	Yes	No	Yes (deletion)
Maximum penalty	NZ$10,000 fine; Tribunal damages	€20m or 4% turnover	£17.5m or 4% turnover	A$50m+ for serious interference	Per-violation fines

EU adequacy: why New Zealand's status matters

New Zealand is one of a small number of countries the European Commission recognises as providing adequate protection, first decided in 2012 and confirmed in its January 2024 review. The UK carried that recognition into UK law. Adequacy lets European and UK businesses send personal data to New Zealand without extra contracts, which is valuable for New Zealand exporters, SaaS firms and agencies. IPP 3A was introduced partly to keep that status.

Privacy Act 2020 Compliance Checklist: 10 Steps

Appoint a privacy officer. Every agency must have one or more (section 201). In a small business it can be the owner.
Map your personal information. List what you collect, from where (including indirect sources), why, where it is stored, who sees it and which countries it goes to.
Rewrite your privacy statement. Plain English, covering every IPP 3 and IPP 3A item, with a date and contact.
Fix collection points. Trim forms, add notices next to fields, remove pre-ticked boxes, add care for under-18s.
Set up IPP 3A notices. Template notices for each indirect source, or a documented exception.
Secure your systems. MFA, named accounts, encryption, access reviews every quarter, tested backups.
Paper your vendors. Section 11 agent terms or IPP 12 safeguards (OPC model clauses) for every processor, especially overseas.
Write a breach plan. Who decides, the serious-harm test, NotifyUs, templates, a breach register.
Handle requests. A process to answer access and correction requests within 20 working days.
Train and review. Annual staff training and a yearly privacy review; privacy impact assessments for new projects, AI and biometrics.

Free tools from the Office of the Privacy Commissioner

Priv-o-matic (OPC): a free privacy statement generator.
NotifyUs (OPC): online breach notification and a serious-harm self-assessment.
Privacy 101 and other e-learning modules (OPC): free staff training.
Model contract clauses (OPC): a template for IPP 12 cross-border disclosures.
Privacy impact assessment toolkit (OPC).

Using an Offshore Marketing Agency Under the Privacy Act 2020

Digital Masters 360 is a digital marketing agency based in Hyderabad, India, working 100% online for clients in New Zealand, Australia, the UK, the US, Canada, Europe and Asia. This section answers the questions New Zealand buyers ask us before they share a single login.

Is it legal to share customer data with an agency in India?

Yes, if it is structured properly. The Privacy Act 2020 does not ban using providers outside New Zealand. It requires that you stay accountable for the information and that it stays protected. There are two lawful routes, and a careful agency relationship uses both.

Route 1: the agency as your section 11 agent

When an agency works inside your accounts (your Google Ads, GA4, CRM and CMS) and uses data only to deliver your campaigns, it is acting as your agent. The information is treated as held by you, IPP 12 does not apply to giving it access, and you remain responsible for its conduct. The contract should say the agency acts only on your instructions, cannot use the data for itself and must return or delete it at the end.

Route 2: IPP 12 safeguards for any copies

Where the agency will hold copies of personal information (for example, exported lead lists for analysis), add IPP 12 safeguards: the OPC’s model contract clauses, or equivalent terms requiring comparable protection. Do not rely on India’s privacy law alone; India’s Digital Personal Data Protection Act 2023 and DPDP Rules 2025 are being phased in, and the OPC has not prescribed India as a comparable country.

What we never do

We never buy, sell or rent personal data.
We never use client customer data to train AI models or for our own marketing.
We never use shared passwords or personal devices for client work.
We never export a customer list when the platform can do the job inside your account.

How Digital Masters 360 handles New Zealand client data

Access: client-owned accounts and least privilege

You own every ad account, analytics property and CRM. We work through named user invitations with the lowest role that does the job, protected by multi-factor authentication. You can see exactly who on our team has access.

Storage: no unnecessary copies

Work happens in your platforms. When an export is unavoidable, it lives in an encrypted, access-controlled workspace, is listed in a data register, and is deleted when the task ends.

Breach support

We tell you of any suspected incident affecting your data within 24 hours of discovering it, with the facts you need to run the serious-harm assessment and, if needed, notify through NotifyUs.

Exit and deletion

At the end of an engagement we hand back all assets, remove our users from your accounts and confirm deletion of any copies in writing.

Revoke access in one click

Tip

Revoke access in one click: because everything runs through named users in your own accounts, you can remove us from Google Ads, GA4, Meta Business Manager or HubSpot in seconds, without changing your passwords.

Cost: New Zealand agency vs offshore (NZD, USD, AUD, GBP, EUR)

Service (monthly)	Typical NZ agency	DM360 (NZD)	USD	AUD	GBP	EUR
SEO Starter (1 site, local)	NZ$1,500–2,500	NZ$1,090	US$650	A$990	£495	€590
SEO + Content Growth	NZ$2,500–4,000	NZ$2,090	US$1,250	A$1,890	£950	€1,130
Full-funnel (SEO, PPC, social)	NZ$4,000–8,000+	NZ$3,990	US$2,390	A$3,590	£1,800	€2,150
White-label for agencies	Not usually offered	from NZ$870	from US$520	from A$790	from £395	from €470
Privacy-ready marketing audit (one-off)	NZ$2,500+	NZ$1,590	US$950	A$1,490	£720	€860

Local ranges are indicative, based on 2026 pricing guides published by New Zealand agencies, which commonly quote SEO retainers from about NZ$500 to NZ$5,000+ per month depending on scope. Prices exclude GST; the GST treatment of imported services depends on your registration status, so check with your accountant. Currency figures are rounded and fixed at the start of each contract so exchange rates do not change your invoice.

Time zone overlap with New Zealand

Your location	Your time zone	Our 7:00–16:00 IST shift in your time	Live overlap
Auckland, Wellington, Christchurch (summer, NZDT)	UTC+13	14:30–23:30	14:30–17:30 daily
Auckland, Wellington, Christchurch (winter, NZST)	UTC+12	13:30–22:30	13:30–17:30 daily
Sydney, Melbourne (AEDT)	UTC+11	12:30–21:30	12:30–17:30 daily
London (GMT/BST)	UTC+0/+1	01:30–11:30	09:00–11:30 daily
New York (EST/EDT)	UTC−5/−4	20:30–06:30	On request: early-morning calls

Communication and reporting

Daily: async updates in your Slack or Microsoft Teams channel before your afternoon.
Weekly: a 30-minute Zoom or Google Meet call in your afternoon (NZ 2:30–5:30 pm window).
Monthly: a Looker Studio dashboard plus a written report in plain English: what we did, what changed, what is next.
Response time: within 4 business hours during overlap; urgent issues by phone or WhatsApp.
One named account manager who knows your business, not a ticket queue.

Contracts, NDAs, payments and onboarding

Contracts and NDAs

Every engagement has a written services agreement, a mutual NDA signed before you share anything, and a data processing schedule that sets out our section 11 agent role, IPP 5 security measures, IPP 12 safeguards, breach notice within 24 hours and deletion on exit. Agreements can be governed by New Zealand law on request.

Payments

Monthly invoices in NZD, AUD, USD, GBP or EUR. Pay by international bank transfer, Wise or card via a PCI-compliant gateway. No long lock-ins: 30 days’ notice after an initial three-month term.

Onboarding in five steps

1) Discovery call. 2) NDA and data processing schedule signed. 3) Named-user access to your accounts. 4) Audit and 90-day plan within 10 working days. 5) Weekly delivery and monthly reporting.

White-label partnerships for New Zealand agencies

New Zealand agencies can resell our SEO, content, PPC management and privacy-ready tracking audits under their own brand. We work as your subcontractor and as a section 11 agent of your client, never contacting your clients directly unless you ask. You get unbranded reports, a shared Slack channel, NZ-afternoon availability and partner pricing from NZ$870 per month.

Common Privacy Act 2020 Mistakes

Mistake	Why it is a problem	Fix
Copying an Australian or GDPR privacy policy	Different principles; misses IPP 3A and IPP 12	Write to the 14 NZ IPPs
Thinking small businesses are exempt	That is Australian law, not New Zealand law	Comply from your first customer
Importing bought lists silently	IPP 2, IPP 3A and UEM Act issues	Notify or document an exception; get consent to email
Pixels on every page	Can disclose sensitive information to platforms	Exclude sensitive pages; server-side tagging
Shared logins with agencies	IPP 5 security failure; no audit trail	Named users with MFA
No retention schedule	IPP 9 breach and bigger breach impact	Delete on a timetable
Ignoring access requests	20 working day limit; common complaint	One inbox, one owner, a log
Not documenting breach decisions	Hard to defend a no-notify decision	Keep a breach register

Privacy Act 2020 Glossary

Agency: Any person or organisation that collects or holds personal information.
Codes of practice: Rules issued by the Commissioner that modify the IPPs for a sector or technology.
Compliance notice: A binding order from the Commissioner to fix a breach of the Act.
HRRT: Human Rights Review Tribunal, which hears privacy claims and can award damages.
IPP: Information privacy principle; there are 14, set out in section 22.
IPP 3A: The duty, from 1 May 2026, to notify people when you collect their information indirectly.
Notifiable privacy breach: A privacy breach reasonably believed to cause or be likely to cause serious harm.
NotifyUs: The OPC's online tool for reporting breaches.
OPC: Office of the Privacy Commissioner, Te Mana Mātāpono Matatapu.
Privacy officer: The person each agency must appoint to oversee privacy (section 201).
Section 11 agent: A provider that holds information solely on your behalf; you stay responsible.
UEM Act: Unsolicited Electronic Messages Act 2007, New Zealand's anti-spam law.

Privacy Act 2020: Frequently Asked Questions

What is the Privacy Act 2020?

The Privacy Act 2020 is New Zealand's main privacy law. It came into force on 1 December 2020, replacing the Privacy Act 1993, and controls how agencies collect, store, use and share personal information through 14 information privacy principles. It also makes serious privacy breaches notifiable and is enforced by the Office of the Privacy Commissioner.

How many privacy principles are in the Privacy Act 2020?

There are 14. The Act started with 13 information privacy principles in section 22, and the Privacy Amendment Act 2025 added IPP 3A, which requires agencies to notify people when they collect their personal information from another source. IPP 3A took effect on 1 May 2026.

Who does the Privacy Act 2020 apply to?

It applies to almost every agency that collects or holds personal information in New Zealand: businesses of any size, sole traders, charities, clubs, schools and government agencies. Individuals acting in a purely personal or household capacity, and news entities in their news activities, are the main exclusions.

Does the Privacy Act 2020 apply to small businesses?

Yes. Unlike Australia, New Zealand has no small-business exemption. A sole trader or small online store has the same core obligations as a large company, although what counts as reasonable security and process can be scaled to the size of the business.

Does the Privacy Act 2020 apply to overseas businesses?

Yes, if they carry on business in New Zealand. Section 4 extends the Act to overseas agencies for actions taken in the course of carrying on business in New Zealand, even without a physical presence or a New Zealand company, and wherever the information is held.

What is IPP 3A?

IPP 3A is the information privacy principle on collection of personal information from a source other than the individual. Since 1 May 2026, if you obtain someone's information indirectly, such as from a bought list, partner or enrichment tool, you must take reasonable steps to tell them about the collection unless an exception applies, such as the information being publicly available or the person already knowing.

When do I have to report a privacy breach in New Zealand?

You must notify the Privacy Commissioner and affected individuals as soon as practicable after becoming aware of a notifiable privacy breach, meaning one it is reasonable to believe has caused or is likely to cause serious harm. The OPC expects notification generally within 72 hours, using its online NotifyUs tool.

What are the penalties under the Privacy Act 2020?

Offences such as failing to notify a notifiable breach, misleading an agency to obtain information or ignoring a compliance notice carry fines of up to NZ$10,000. The Commissioner can also issue compliance notices and access directions, and the Human Rights Review Tribunal can award damages. A civil penalty regime has been proposed but was not law as at October 2026.

How long do I have to respond to a privacy access request?

You must respond as soon as reasonably practicable and no later than 20 working days after receiving the request. You can extend the time in specified circumstances if you tell the person within the 20 working days, with reasons.

Is the Privacy Act 2020 the same as the GDPR?

No. The GDPR requires a lawful basis for processing, gives a right to erasure and allows fines of up to 20 million euros or 4% of global turnover. New Zealand's Act is principles-based, has no general erasure right and lower fines. However, the European Commission recognises New Zealand as providing adequate protection, so EU personal data can flow to New Zealand without extra safeguards.

Does the Privacy Act 2020 cover cookies and tracking pixels?

New Zealand has no specific cookie law, but the Privacy Act applies whenever cookies, pixels or tags collect or share information about identifiable people. You must explain the tracking in your privacy statement, avoid sending sensitive information to platforms, and meet IPP 12 when data goes overseas.

Can I send personal information overseas under the Privacy Act 2020?

Yes, if IPP 12 is met. You can disclose to a foreign recipient if the person authorises it after being told the protection may not be comparable, if the recipient is subject to comparable privacy laws or carries on business in New Zealand, or if you have comparable safeguards such as the OPC's model contract clauses. IPP 12 does not apply to a provider acting purely as your agent under section 11.

Do I need a privacy officer?

Yes. Section 201 requires every agency to appoint one or more privacy officers to encourage compliance, handle access and correction requests and work with the Commissioner. In a small business, the owner or manager can be the privacy officer.

What changed in the Privacy Act 2020 in 2025 and 2026?

The Privacy Amendment Act 2025 added IPP 3A, in force from 1 May 2026. The Biometric Processing Privacy Code 2025 applied to new biometric processing from 3 November 2025 and existing processing from 3 August 2026. The Government is also consulting on a civil penalty regime as part of its 2026 cyber security plan.

Is it safe for a New Zealand business to outsource marketing to an agency in India?

It can be, if structured properly. Keep data in accounts you own, give the agency named-user access with multi-factor authentication, sign a contract that makes it your section 11 agent with IPP 5 security duties and breach notice, and add IPP 12 safeguards for any copies it holds. Check the agency's references and ask for its data handling policy in writing.

How much does a privacy-ready marketing audit cost?

Digital Masters 360 offers a one-off privacy-ready marketing audit for NZ$1,590 (about US$950), covering forms, pixels and tags, email consent, ad audiences, vendors and IPP 3A sources, with a prioritised fix list. It is a marketing compliance review, not legal advice.

Free for New Zealand businesses

Is Your Marketing Ready for IPP 3A?

Send us your website and we will check your forms, pixels, email consent and third-party data sources against the Privacy Act 2020, and reply with a short, prioritised fix list. No obligation, no login needed for the first check.

Replies within one NZ business day · Calls available 2:30–5:30 pm NZ time

Chenna Reddy, Founder, Digital Masters 360

Chenna leads a Hyderabad-based team delivering SEO, paid media and analytics to clients in New Zealand, Australia, the UK and North America, with a focus on privacy-ready tracking and consent.

Disclaimer

This guide is general information about the Privacy Act 2020 as at 5 October 2026. It is not legal advice. For decisions about your obligations, speak with a New Zealand privacy lawyer or contact the Office of the Privacy Commissioner. Spelling follows New Zealand English (organisation, authorise, programme).