New Zealand

The extraterritorial reach was one of the headline changes from the Privacy Act 1993 to the Privacy Act 2020, which commenced on 1 December 2020. We could not open the statute text itself: New Zealand's official legislation site sits behind an automated-traffic challenge that blocks machine fetching, so the exact wording of the application provision is recorded in the unconfirmed list rather than quoted here. The regulator's own guidance is the basis for the scope statement, and the Privacy Commissioner has publicly pushed the same point at overseas-owned businesses operating here, telling them that a privacy policy written to another country's law is not compliance.

Sector by sector, checked on 18 August 2026. BANKING — open. The Reserve Bank's outsourcing policy for large banks turns on control, not geography, and says in terms that a required system does not have to be located in New Zealand. It applies only to New Zealand-incorporated banks with net liabilities above ten billion New Zealand dollars, roughly six billion United States dollars. PAYMENTS, INSURANCE, SECURITIES — no localisation rule found, checked 18 August 2026, confidence medium. We could not reach the securities regulator's site from this environment, so the securities and insurance position is recorded as unverified rather than as a clean negative. GOVERNMENT AND PUBLIC SECTOR — the strictest area. Cabinet policy allows a public cloud service, onshore or offshore, only for information classified RESTRICTED or below, and pushes agencies to move RESTRICTED information onshore over time where a suitable New Zealand service exists. Anything more sensitive than RESTRICTED may not go into public cloud at all. The government security manual also tells agencies they should not buy offshore technology services from countries New Zealand has no security agreement with. TAX AND BUSINESS RECORDS, ALL INDUSTRIES — a genuine residency default. Records must be kept at a place in New Zealand unless the tax authority has authorised otherwise. HEALTH — governed by a separate binding code with its own version of the cross-border rule. Extra care applies but no hard wall was found. BIOMETRICS — a separate binding code issued in 2025 adds a proportionality test before you may process biometric information at all. TELECOM — the network security regime run by the national cyber agency regulates changes to public telecommunications networks. No data-residency requirement was found in the material we could open, checked 18 August 2026, confidence low. GAMBLING — a new licensed online casino regime is being built. Detailed operator obligations, including any record-location rules, were still unpublished at the date of this record. MAPPING AND GEOSPATIAL, EDUCATION, DEFENCE — no separate localisation rule found, checked 18 August 2026, confidence low.

The six grounds under the cross-border principle are: the person authorises it after being told the protections may not be comparable; the receiver does business in New Zealand and is itself caught by the Act; the receiver is subject to privacy laws that overall give comparable safeguards; the receiver signs up to a binding scheme named in regulations; the receiver is in a country named in regulations; or you reasonably believe the receiver is required to protect the information to a comparable standard, typically by contract. Two of those six are gates that were built and never opened. We found no order naming any country and no order naming any binding scheme, checked 18 August 2026. Treat the country route and the scheme route as unavailable and plan on the contract route. Separately, the regulator holds a power to serve a transfer prohibition notice stopping a specific flow of personal information out of New Zealand. It is a targeted blocking power rather than a country blacklist, and we found no evidence of it being used. The tax records model is an approval model with a published allowlist. Inland Revenue names third-party providers approved to hold New Zealand taxpayer electronic records offshore, and the list has roughly thirty names on it including several mainstream accounting and payroll platforms. If your provider is on that list you need no separate approval. If it is not, you apply in writing.

Observable evidence of activity, all from the regulator's own site: a decision that a lost memory stick was a notifiable breach, dated 31 March 2026; a decision naming two supermarket operators for a collection breach, dated 17 December 2025; decisions in July 2025 about an enforcement officer misusing personal information and a finance business failing to recognise a fraud incident as a notifiable breach; a public inquiry report into a supermarket group's facial recognition trial published 4 June 2025; and compliance notices arising from the Manage My Health inquiry against both the platform and the national health agency in 2026. The office publicly warns of delays because demand for its services is high, which is itself evidence of a working caseload rather than a dormant body. What the regulator can actually do: issue a compliance notice requiring an organisation to fix something, issue an access direction requiring release of information, serve a transfer prohibition notice, run a public inquiry, and refer a complaint on to the Human Rights Review Tribunal, which can award damages to the affected individual. There is no percentage-of-turnover fine and no administrative penalty regime. Sector regulators operate alongside it. The Reserve Bank supervises bank outsourcing, Inland Revenue polices record storage, the Department of Internal Affairs is building the online casino licensing regime, the Government Chief Digital Officer sets cloud policy for public agencies, and the National Cyber Security Centre regulates telecommunications network security. All are functioning.

Verified floor: seven tax years for business records, including electronic ones, extendable by the Commissioner of Inland Revenue to ten years in specified circumstances or during an audit or investigation. The ceiling is set by the retention principle in the privacy law, which sets no fixed period at all. It is a necessity test, applied case by case, and it is one of the few New Zealand obligations that genuinely requires an organisation to think rather than to look up a number. Public sector bodies face the reverse problem: they may not simply delete. Public records are subject to a separate archives regime that controls disposal. We could not open the archives authority's guidance pages from this environment, so the interaction between the retention principle and the public records regime is recorded as unverified. Other sector floors commonly cited in New Zealand practice — anti-money-laundering records, employment wage and time records, and the ten-year rule for health information — could not be verified against a government source during this run and are listed in the unconfirmed section rather than asserted here.

Serious harm is judged on a list that includes physical harm, financial fraud, identity theft, psychological injury, loss of employment, blackmail, kidnapping and threats to life. The regulator's guidance is to call the police first if harm to a person looks imminent, then notify. What is NOT a second clock, for most organisations: reporting a cyber incident to the national cyber agency is voluntary in New Zealand, not mandatory. There is no general six-hour or twenty-four-hour cyber reporting duty of the kind India, Singapore or the European Union impose. Where additional clocks do exist they are narrow and we could not pin their deadlines down from official sources during this run. Telecommunications network operators have duties under the network security regime administered by the National Cyber Security Centre, which centres on notifying proposed network changes rather than on incident hours. Licensed financial institutions have their own supervisory notification duties. Both are listed as unverified. Failing to notify is itself an offence and has been the subject of a formal decision: in September 2024 the regulator publicly recorded a care provider taking two years to report a notifiable breach.

1. THE AGENT RULE. The regulator's own guidance says that where an overseas service provider is acting as your agent you remain the holder of the information and the cross-border principle is not triggered. This is the single most consequential and least understood feature of New Zealand privacy law. It cuts both ways: you save a contract exercise, but you cannot point at the vendor when things go wrong, and you must still meet the security principle for everything they do. 2. TAX RECORDS DEFAULT TO NEW ZEALAND. Business records must be kept at a place in New Zealand unless the Commissioner of Inland Revenue authorises offshore storage. Most people discover this after they have already migrated an accounting system. The escape hatch is that Inland Revenue publishes a list of approved offshore storage providers, and if your provider is on it you need nothing further. Check the list before you migrate, not after. 3. TWO EMPTY LISTS. The cross-border principle offers a route based on the recipient being in a country named in regulations, and another based on the recipient joining a binding scheme named in regulations. We found no order populating either, checked 18 August 2026. Do not design a transfer programme around them. 4. THE MONEY IS NOT WHERE YOU EXPECT. The maximum penalty in the privacy law is ten thousand New Zealand dollars, about six thousand United States dollars, and it is a court-imposed criminal fine for specific offences such as misleading an organisation to obtain someone else's information. The real exposure is the Human Rights Review Tribunal, which can award compensation to the individual, plus a compliance notice that forces you to change how you operate. 5. NO CHILDREN'S AGE THRESHOLD FOUND. We found no separate age of digital consent and no separate children's data regime in New Zealand privacy law, checked 18 August 2026. That is the opposite of a comfort: it means nothing shields you, and the regulator has made children's privacy a declared focus area, with a public survey putting children's privacy on social media as the leading public concern at seventy-one per cent. 6. GOVERNMENT BUYERS BRING THEIR OWN CEILING. If you sell to a New Zealand public agency, the constraint is not privacy law, it is the cloud classification rule. Nothing above RESTRICTED goes into a public cloud, and agencies are being nudged to move RESTRICTED information onshore over time. That is a procurement blocker, not a legal one, and it does not appear in any privacy summary.

DATED AND CERTAIN 1 May 2026 — a new principle requiring you to tell people when their information was collected indirectly came into force. The regulator amended its binding codes in March 2026 to match and ran targeted guidance consultation in April 2026. This one already bites. 14 August 2026 — expressions of interest for online casino licences closed. September 2026 — the licence auction. October 2026 — licence applications open. 1 December 2026 — operators that did not apply must cease serving New Zealand. 2027 — the licensed regime fully operational. Up to fifteen licences, each up to three years, no operator holding more than three. Detailed compliance rules, including any record-location requirements, were promised for mid-2026 and were not published in a form we could verify at the date of this record. 7 November 2026 — general election. STATUS UNCERTAIN The Biometric Processing Privacy Code 2025 is in force as a binding code. We could not verify its exact commencement date or the transition deadline for organisations already using biometrics; both are in the unconfirmed list. The Customer and Product Data Act 2025 sets up New Zealand's consumer data right, starting with banking. We could not verify the commencement dates of the banking designation regulations. DORMANT SWITCHES — powers that already exist and can change the picture with no consultation 1. The Privacy Commissioner can serve a transfer prohibition notice stopping a specific flow of personal information out of New Zealand. No public use found. 2. The government can name countries, and separately name binding schemes, as approved routes for sending data abroad. Both powers appear unused. Using them would loosen, not tighten. 3. Inland Revenue can add to or remove names from its approved offshore record storage list. A removal would strand every taxpayer relying on that provider. 4. The cloud classification ceiling for public agencies is Cabinet policy, not legislation, and can be changed by Cabinet alone. EUROPEAN UNION ADEQUACY — stable. New Zealand's adequacy finding was maintained in January 2024 and the regulator continues six-monthly supplementary reporting to the European Commission, the twenty-second of which was filed in December 2025. Nothing suggests it is at risk, but it is the one dependency that would change New Zealand's value as a data destination overnight if it lapsed.