Processes personal data, in New Zealand

Privacy Act 2020 (NZ), No 31, s. 22 (IPP 12) · Read the law's page

• Before disclosing personal information to an overseas recipient, confirm one of information privacy principle 12's safeguards applies: the individual's informed authorisation, the recipient being subject to this Act or a comparably safeguarded overseas law, the recipient's participation in a prescribed binding scheme, the recipient being subject to a prescribed country's laws, or another reasonable basis to believe the recipient will protect the information comparably.

Privacy Act 2020 (NZ), No 31, ss. 112-118 · Read the law's page

• Notify the Privacy Commissioner as soon as practicable after becoming aware that a notifiable privacy breach, one reasonably believed to have caused or be likely to cause serious harm, has occurred.
• Notify each affected individual, or give public notice if individual notice is not reasonably practicable, as soon as practicable after becoming aware of a notifiable privacy breach, unless a statutory exception or permitted delay applies.
• Failing to notify the Commissioner of a notifiable privacy breach without reasonable excuse is an offence carrying a fine of up to $10,000.

Privacy Act 2020 (NZ), No 31, ss. 123, 126, 130, 212 · Read the law's page

• Comply with a compliance notice issued by the Commissioner to remedy a breach of the Act, an interference with privacy, or a breach of a code of practice, or face enforcement proceedings before the Human Rights Review Tribunal.
• Do not obstruct, hinder, or resist the Commissioner, make a false or misleading statement, falsely claim authority under the Act, impersonate an individual to obtain or alter their personal information, or destroy a document to defeat a request; each is an offence carrying a fine of up to $10,000.

Privacy Act 2020 (NZ), No 31, ss. 4, 22 (IPP 1, 2, 13) · Read the law's page

• Do not collect personal information unless it is for a lawful purpose connected with a function or activity of your organisation and the collection is necessary for that purpose.
• Collect personal information directly from the individual concerned unless an exception applies, such as the individual's authorisation, the source being a publicly available publication, or non-compliance not prejudicing the individual's interests.
• Comply with the Information Privacy Principles as an overseas organisation if you are carrying on business in New Zealand in relation to personal information you collect or hold, even without a New Zealand place of business, staff, or profit motive.
• Do not assign a unique identifier to an individual unless it is necessary to carry out your organisation's functions efficiently, and do not assign the same identifier already assigned by another agency except in limited circumstances.

Biometric Processing Privacy Code 2025 (NZ), rules 1 to 13 · Read the law's page

• Before collecting biometric information, check that biometric processing serves a lawful purpose connected with your function or activity, is necessary and effective for that purpose, cannot reasonably be achieved as effectively by an alternative with less privacy risk, is backed by the privacy safeguards that are reasonable in the circumstances, and that you believe on reasonable grounds it is proportionate to its likely impacts on individuals, weighing the privacy risk against the benefit and the cultural impacts on Māori (rule 1).
• You may run a trial for no longer than needed to meet its objectives, with an initial period of at most 6 months and at most one further period of at most 6 months, and defer the necessity and alternatives check until the trial ends (rules 1(2) and 10(3)).
• Collect a biometric sample from the individual concerned unless an exception applies, and collect biometric information only by lawful means that are fair and do not intrude to an unreasonable extent on the individual's personal affairs, particularly where children or young persons are involved (rules 2 and 4).
• Take reasonable steps to make each individual aware, clearly and conspicuously and before or at the time of collection, that their biometric information is being collected, each specific purpose, and whether an alternative to biometric processing is available, with a way to get further information; and, before collection or as soon as practicable after, the intended recipients, who collects and holds the information, any legal authority, the consequences of not providing it, their access and correction rights, your retention period, how to raise a concern or complain, their right to complain to the Privacy Commissioner, and where your proportionality assessment or a summary of it can be viewed (rule 3).
• If you collect biometric information other than from the individual concerned, take reasonable steps to make them aware of the same matters as soon as reasonably practicable after collection; this applies to information collected on or after 1 May 2026, or on or after 3 August 2026 for processing that began on or before 3 November 2025 (rule 3A).
• Do not use biometric information for biometric categorisation, meaning inferring health information or an individual's personality, mood, emotion, intention, mental state, fatigue, alertness or attention level, or placing them in a demographic category such as sex, ethnicity or sexual orientation, unless an exception applies: categorising by age or by a demographic category that is not a prohibited ground of discrimination, assisting accessibility, preventing or lessening a serious threat to public health or safety or to someone's life or health, ethically approved research, fatigue or alertness detection necessary to prevent risk to health or safety, or detecting health information the individual has expressly authorised (rule 10(5) to (9)).
• Detecting a readily apparent expression is not biometric categorisation, nor is analysis built into a commercial service solely to give individuals their own health or personal information or an entertainment or immersive experience (clause 3(1)).
• Do not use personal information that was not collected under rule 1 for biometric processing, and do not use biometric information held for one type of biometric processing for another type, unless the necessity, safeguards and proportionality checks in rule 10(2) are met; use biometric information for a different purpose only on a ground rule 10(10) lists (rule 10).
• Protect biometric information with reasonable security safeguards against loss, unauthorised access, use, modification or disclosure and other misuse, and do not keep it longer than the purposes for which it may lawfully be used require (rules 5 and 9).
• Give an individual, on request, confirmation of whether you hold biometric information about them, its type and access to it, and correct it or attach their statement of correction on request (rules 6 and 7).
• Take reasonable steps to ensure biometric information is accurate, up to date, complete, relevant and not misleading before you use or disclose it, and disclose it only on a ground rule 11 lists (rules 8 and 11).
• Disclose biometric information to a foreign person or entity in reliance on rule 11 only if the individual authorises it after being told the recipient may not provide comparable safeguards, or you believe on reasonable grounds the recipient is subject to the Privacy Act 2020 as modified by the code, to comparable privacy laws, to a prescribed binding scheme or a prescribed country's laws, or is otherwise required to protect the information comparably (rule 12).
• Assign a biometric template as a unique identifier only if necessary for your functions, and do not assign one the same as another agency's identifier for that individual unless an exception applies (rule 13).

Privacy Act 2020 (NZ), No 31, s. 22 (IPP 3A), inserted by the Privacy Amendment Act 2025 (NZ), No 53, s. 4 · Read the law's page

• If you collect personal information about an individual other than from that individual, including by scraping it from a third-party source, take reasonable steps to make the individual aware, as soon as practicable after collection, of the fact of collection, its purpose, the intended recipients, your identity, any legal authority for the collection, and their access and correction rights.
• This duty does not apply to personal information collected before 1 May 2026, or where the individual has already been made aware of these matters by other means.