New Zealand

The Privacy Act 2020 started on 1 December 2020. One of the biggest changes from the Privacy Act 1993 was that the law now applies even if you have no office in New Zealand. We could not open the statute text itself. New Zealand's official legislation site sits behind an automated-traffic challenge that blocks machine fetching. So the exact wording of the section setting out who is covered is recorded in the unconfirmed list rather than quoted here. The scope statement rests on the regulator's own guidance. The Privacy Commissioner has publicly pushed the same point at overseas-owned businesses operating here. He has told them that a privacy policy written to another country's law is not compliance.

Sector by sector, checked on 18 August 2026. BANKING. Open. The Reserve Bank's outsourcing policy for large banks turns on control, not geography. It says in terms that a required system does not have to be located in New Zealand. It applies only to New Zealand-incorporated banks with net liabilities above ten billion New Zealand dollars, roughly six billion United States dollars. PAYMENTS, INSURANCE, SECURITIES. We found no rule about where data must sit, checked 18 August 2026, confidence medium. We could not reach the securities regulator's site from this environment. So the securities and insurance position is recorded as unverified rather than as a clean negative. GOVERNMENT AND PUBLIC SECTOR. The strictest area. Cabinet policy allows a public cloud service, in New Zealand or overseas, only for information classified RESTRICTED or below. It pushes agencies to move RESTRICTED information into New Zealand over time, where a suitable New Zealand service exists. Anything more sensitive than RESTRICTED may not go into public cloud at all. The government security manual also tells agencies they should not buy offshore technology services from countries New Zealand has no security agreement with. TAX AND BUSINESS RECORDS, ALL INDUSTRIES. A real rule that data must stay in the country. Records must be kept at a place in New Zealand unless the tax authority has allowed otherwise. HEALTH. Governed by a separate binding code with its own version of the cross-border rule. Extra care applies, but we found no outright ban. BIOMETRICS. A separate binding code issued in 2025 adds a proportionality test before you may use biometric information at all. TELECOM. The national cyber agency regulates changes to public telecommunications networks. We found no rule about where data must sit in the material we could open, checked 18 August 2026, confidence low. GAMBLING. A new licensed online casino scheme is being built. Detailed duties for operators, including any rules on where records sit, were still unpublished at the date of this record. MAPPING AND GEOSPATIAL, EDUCATION, DEFENCE. We found no separate rule about where data must sit, checked 18 August 2026, confidence low.

The six grounds under the cross-border principle are these. The person agrees after being told the protections may not be comparable. Or the receiver does business in New Zealand and is itself caught by the Act. Or the receiver is subject to privacy laws that overall give comparable safeguards. Or the receiver signs up to a binding scheme named in regulations. Or the receiver is in a country named in regulations. Or you reasonably believe the receiver must protect the information to a comparable standard, usually by contract. Two of those six routes do not work, because the lists behind them are empty. We found no order naming any country, and no order naming any binding scheme, checked 18 August 2026. Treat the country route and the scheme route as unavailable, and plan on the contract route. Separately, the regulator can serve a transfer prohibition notice. That stops a specific flow of personal information out of New Zealand. It targets one flow rather than banning a country, and we found no evidence of it being used. The tax records model is different. You need approval, and there is a published list of approved providers. Inland Revenue names third-party providers approved to hold New Zealand taxpayer electronic records offshore. The list has roughly thirty names on it, including several mainstream accounting and payroll platforms. If your provider is on that list, you need no separate approval. If it is not, you apply in writing.

Evidence of activity, all from the regulator's own site. A decision that a lost memory stick was a notifiable breach, dated 31 March 2026. A decision naming two supermarket operators for a collection breach, dated 17 December 2025. Decisions in July 2025 about an enforcement officer misusing personal information, and about a finance business failing to recognise a fraud incident as a notifiable breach. A public inquiry report into a supermarket group's facial recognition trial, published 4 June 2025. Compliance notices from the Manage My Health inquiry, against both the platform and the national health agency, in 2026. The office publicly warns of delays because demand for its services is high. That is itself evidence of a working caseload rather than an idle body. Here is what the regulator can actually do. It can issue a compliance notice requiring an organisation to fix something. It can issue an access direction requiring release of information. It can serve a transfer prohibition notice. It can run a public inquiry. And it can refer a complaint on to the Human Rights Review Tribunal. That tribunal can award damages to the person affected. There is no fine based on a percentage of turnover, and no system of administrative penalties. Sector regulators work alongside it. The Reserve Bank supervises bank outsourcing. Inland Revenue polices record storage. The Department of Internal Affairs is building the online casino licensing scheme. The Government Chief Digital Officer sets cloud policy for public agencies. The National Cyber Security Centre regulates telecommunications network security. All are functioning.

The floor we verified: seven tax years for business records, including electronic ones. The Commissioner of Inland Revenue can extend that to ten years in specified circumstances, or during an audit or investigation. The ceiling comes from the retention principle in the privacy law, which sets no fixed period at all. It is a necessity test, applied case by case. It is one of the few New Zealand duties that requires you to think rather than to look up a number. Public sector bodies face the reverse problem. They may not simply delete. Public records are covered by separate archives rules that control disposal. We could not open the archives authority's guidance pages, so we could not confirm how the retention principle interacts with the public records rules. Other floors commonly quoted in New Zealand are anti-money-laundering records, employment wage and time records, and the ten-year rule for health information. We could not confirm any of them against a government source, so they are listed in the unconfirmed section rather than asserted here.

Serious harm is judged on a list. It includes physical harm, financial fraud, identity theft, psychological injury, loss of employment, blackmail, kidnapping and threats to life. The regulator's guidance is to call the police first if harm to a person looks imminent, then notify. There is no second clock for most organisations. Reporting a cyber incident to the national cyber agency is voluntary in New Zealand, not compulsory. There is no general six-hour or twenty-four-hour cyber reporting duty of the kind India, Singapore or the European Union impose. Where extra clocks do exist they are narrow, and we could not confirm their deadlines from official sources. Telecommunications network operators have duties under the network security rules run by the National Cyber Security Centre. Those focus on notifying proposed network changes rather than on incident hours. Licensed financial institutions have their own supervisory notification duties. Both are listed as unverified. Failing to notify is itself an offence, and it has been the subject of a formal decision. In September 2024 the regulator publicly recorded a care provider taking two years to report a notifiable breach.

1. THE SUPPLIER RULE. The regulator's own guidance says that where an overseas service provider acts as your agent, you remain the holder of the information. The cross-border principle is then not triggered. This is the most important and least understood feature of New Zealand privacy law. You save yourself a contract exercise. But you cannot point at the vendor when things go wrong, and you must still meet the security principle for everything they do. 2. TAX RECORDS DEFAULT TO NEW ZEALAND. Business records must be kept at a place in New Zealand, unless the Commissioner of Inland Revenue allows offshore storage. Most people discover this after they have already moved an accounting system. There is a way out. Inland Revenue publishes a list of approved offshore storage providers. If your provider is on it, you need nothing further. Check the list before you migrate, not after. 3. TWO EMPTY LISTS. The cross-border principle offers a route based on the receiver being in a country named in regulations. It offers another based on the receiver joining a binding scheme named in regulations. We found no order filling either list, checked 18 August 2026. Do not design a transfer programme around them. 4. THE MONEY IS NOT WHERE YOU EXPECT. The maximum penalty in the privacy law is ten thousand New Zealand dollars, about six thousand United States dollars. It is a court-imposed criminal fine, for specific offences such as misleading an organisation to obtain someone else's information. The real exposure is the Human Rights Review Tribunal, which can award compensation to the person affected. Add to that a compliance notice that forces you to change how you operate. 5. NO AGE THRESHOLD FOR CHILDREN. We found no separate age of digital consent, and no separate set of children's data rules in New Zealand privacy law, checked 18 August 2026. That is not a comfort. It means nothing shields you. The regulator has made children's privacy a declared focus area. A public survey put children's privacy on social media as the leading public concern, at seventy-one per cent. 6. GOVERNMENT BUYERS BRING THEIR OWN CEILING. If you sell to a New Zealand public agency, the limit is not privacy law. It is the cloud classification rule. Nothing above RESTRICTED goes into a public cloud, and agencies are being nudged to move RESTRICTED information into New Zealand over time. That is a buying blocker, not a legal one, and it does not appear in any privacy summary.

DATED AND CERTAIN 1 May 2026. A new principle came into force. You must tell people when their information was collected from someone other than them. The regulator amended its binding codes in March 2026 to match, and ran targeted guidance consultation in April 2026. This one already applies. 14 August 2026. Expressions of interest for online casino licences closed. September 2026. The licence auction. October 2026. Licence applications open. 1 December 2026. Operators that did not apply must stop serving New Zealand. 2027. The licensed scheme fully operational. Up to fifteen licences, each up to three years, with no operator holding more than three. Detailed compliance rules, including any rules on where records sit, were promised for mid-2026. They were not published in a form we could verify at the date of this record. 7 November 2026. General election. STATUS UNCERTAIN The Biometric Processing Privacy Code 2025 is in force as a binding code. We could not confirm its exact start date, or the deadline for organisations already using biometrics. Both are in the unconfirmed list. The Customer and Product Data Act 2025 sets up New Zealand's consumer data right, starting with banking. We could not confirm the start dates of the banking designation regulations. POWERS THAT ALREADY EXIST AND CAN CHANGE THINGS WITH NO CONSULTATION 1. The Privacy Commissioner can serve a transfer prohibition notice, stopping a specific flow of personal information out of New Zealand. We found no public use of it. 2. The government can name countries, and separately name binding schemes, as approved routes for sending data abroad. Both powers appear unused. Using them would loosen the rules, not tighten them. 3. Inland Revenue can add names to, or remove names from, its approved offshore record storage list. A removal would strand every taxpayer relying on that provider. 4. The cloud classification ceiling for public agencies is Cabinet policy, not legislation. Cabinet can change it alone. EUROPE'S DECISION ON NEW ZEALAND. Stable. Europe's official decision that New Zealand is safe enough was maintained in January 2024. The regulator keeps filing six-monthly supplementary reports to the European Commission. The twenty-second was filed in December 2025. Nothing suggests it is at risk. But it is the one dependency that would change New Zealand's value as a data destination overnight if it lapsed.