PrivacyTerrain

Editorial caveat

Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.

medium confidence, Solid seeded coverage, with moderate enforcement detail still to improve.

At a glance

Key presentation points

A compact summary of high-signal fields before the full structured record.

Effective statusin-force1 primary + 1 secondary • Reviewed 17/04/2026

Territorial scopeApplies to agencies carrying on business in New Zealand, even if they do not have a physical presence there.1 primary + 1 secondary • Reviewed 17/04/2026

Regulator or enforcement authority summaryOffice of the Privacy Commissioner1 primary • Reviewed 17/04/2026

Requires legal basisNo1 primary + 1 secondary • Reviewed 17/04/2026

Structured record

Regulation details grouped by topic

Each value keeps its field context, linked sources, notes, and review date together to avoid detached or ambiguous statements.

Identity

Effective status: in-forceSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Law status: activeSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Effective date: 2020-12-01Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Last amended: 2020-12-01Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Scope

Extraterritorial application: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Territorial scope: Applies to agencies carrying on business in New Zealand, even if they do not have a physical presence there.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Private sector coverage: Applies to agencies in the private sector, broadly defined.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Public sector coverage: Public agencies are also covered under the Privacy Act 2020.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Definitions

Personal data definition: Personal information means information about an identifiable individual.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Sensitive data recognized: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Legal Basis

Legal bases: authorized purpose, consent, permitted use under information privacy principlesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Requires legal basis: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Rights

Right of access: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Right to deletion: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Right to object: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Right to portability: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Right to appeal: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Right to erasure or delete summary: No broad standalone erasure rightSupport: 1 primary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary)Note: New Zealand is better summarized through its own privacy principle structure rather than a simple erasure label.
Right to rectification or correction summary: Correction rightSupport: 1 primary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary)Note: New Zealand includes correction rights within its privacy principles framework.

Breach

Breach deadline (hours): 0Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Breach notification required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Governance

DPO required: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Impact assessment required: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Records of processing required: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Enforcement

Maximum fine: The enforcement model remains comparatively moderate, though compliance notices and reputational risk are meaningful.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Private right of action: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Regulator or enforcement authority summary: Office of the Privacy CommissionerSupport: 1 primary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary)Note: New Zealand's privacy oversight centers on the Privacy Commissioner.

Transfers

Cross-border transfer restricted: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Data localization required: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Marketing

Cookie consent rule: Cookie compliance is shaped by transparency, fairness, and online tracking guidance rather than a dedicated cookie law.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Privacy Act 2020 text (primary); New Zealand OPC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Official sources

Privacy Act 2020 textPrimary official law • en • html
New Zealand OPC guidanceSecondary official material • en • html

New Zealand