Privacy Act 2020: what NZ businesses must do with customer data

The Privacy Act 2020 governs how agencies collect, use and disclose personal information. Businesses need privacy policies, lawful grounds for collection and security safeguards proportionate to harm.

Notifiable privacy breaches must be reported to the Office of the Privacy Commissioner and often to affected individuals. Marketing using purchased lists without consent remains a top complaint category.

Cross-border cloud storage is allowed with due diligence but you remain accountable. AI tools trained on customer chats may be a privacy issue if retention and purpose were not disclosed.

regulation.nz maps all 321 NZ regulatory bodies in one place. A $8.99 AI consultation identifies every regulator you need, the order to apply, fees and timelines — then prepares applications for checkout. OIA requests, complaints and appeals are always free.