Privacy Act 2020

Protecting Personal Information in New Zealand

The Privacy Act 2020 is New Zealand’s main law governing how organisations collect, store, use and disclose personal information.

The Act gives people privacy rights and establishes rules that organisations must follow when handling personal information.

This is particularly important in Information Technology because modern organisations collect and process large amounts of information through websites, applications, databases, cloud services and other digital systems.

The Privacy Act came into force on 1 December 2020 and replaced the Privacy Act 1993.

The Act applies to organisations across New Zealand, including businesses, government agencies, schools and other organisations that collect or process personal information.

The Act is administered by the Office of the Privacy Commissioner.

What is personal information?

Personal information is information that relates to an identifiable individual.

Examples can include:

  • Names

  • Contact details

  • Login information

  • Financial information

  • Customer records

  • Employee records

  • Student records

  • Health information

  • Online account information

  • Other information that can identify an individual

IT systems routinely collect, process and store this type of information, meaning IT professionals have an important role in protecting it.

The Information Privacy Principles

The Privacy Act contains Information Privacy Principles (IPPs). These principles provide rules for how agencies should collect, store, use and disclose personal information.

Principle 1 — Purpose of collection

Personal information should only be collected for a lawful purpose connected with the functions or activities of an organisation.

The information collected should also be necessary for that purpose.

For example, an online retailer may need a customer’s name and delivery address to deliver an order. It would not normally need unrelated personal information simply because its software could collect it.

Principle 2 — Source of information

Personal information should generally be collected directly from the individual concerned, unless an exception applies.

This helps people understand who is collecting their information and why it is being collected.

Principle 3 — Information collected directly from an individual

When personal information is collected directly from an individual, the organisation generally needs to provide information about the collection.

This can include:

  • The fact that information is being collected.

  • Why the information is being collected.

  • Who is expected to receive it.

  • Who is collecting and holding it.

  • Whether providing the information is required or voluntary.

  • The individual’s rights to access and correct their information.

Principle 3A — Information collected indirectly

Information Privacy Principle 3A is a newer privacy requirement that came into effect in May 2026.

It applies when an organisation collects personal information about an individual from someone or somewhere other than the individual themselves.

In these circumstances, organisations may need to take reasonable steps to make the individual aware that their information has been collected, why it was collected, who will receive it and their rights to access and correct the information.

This is particularly relevant to modern IT systems that combine information from different databases, organisations and third-party providers.

Principle 4 — Manner of collection

Personal information must not be collected using unlawful, unfair or unnecessarily intrusive methods.

Organisations should collect information in a way that respects an individual’s personal affairs.

For example, an organisation should not secretly collect excessive information about users simply because its technology allows it to do so.

Principle 5 — Storage and security

Organisations must take reasonable steps to protect personal information against:

  • Loss

  • Unauthorised access

  • Unauthorised use

  • Unauthorised modification

  • Unauthorised disclosure

  • Other forms of misuse

This is highly relevant to IT professionals because digital systems must be designed and maintained to protect the information they hold.

Technical measures that can help protect information include:

  • Strong passwords

  • Multi-factor authentication

  • Access controls

  • Encryption

  • Secure backups

  • Firewalls

  • Software updates

  • Security monitoring

  • Secure disposal of data

Principle 6 — Access

Individuals generally have the right to access personal information that an organisation holds about them.

IT systems should therefore allow organisations to locate and retrieve personal information when a valid access request is made.

Principle 7 — Correction

Individuals can request correction of personal information that an organisation holds about them.

If information is inaccurate, incomplete or misleading, organisations should provide an appropriate process for individuals to request corrections.

IT systems should therefore support appropriate processes for updating inaccurate records.

Principle 8 — Accuracy

Before using or disclosing personal information, organisations should take reasonable steps to ensure that the information is:

  • Accurate

  • Complete

  • Relevant

  • Up to date

  • Not misleading

Incorrect information can result in incorrect decisions and potentially cause harm to individuals.

Principle 9 — Retention

Personal information should not be kept for longer than is required for the purposes for which it may lawfully be used.

IT professionals should therefore consider data-retention policies and secure deletion rather than keeping personal information indefinitely.

Principle 10 — Use

Personal information should generally only be used for the purpose for which it was collected, unless an exception applies.

For example, information collected to provide a particular service should not automatically be reused for an unrelated purpose.

Principle 11 — Disclosure

Personal information should generally only be disclosed for the purpose for which it was collected or where another permitted situation applies.

This is particularly important when organisations use:

  • Cloud providers

  • Marketing platforms

  • Analytics services

  • External contractors

  • Software-as-a-Service platforms

  • Third-party applications

Organisations need to understand what information is being shared, who it is being shared with and whether the disclosure is permitted.

Principle 12 — Disclosure outside New Zealand

The Privacy Act contains additional requirements when personal information is disclosed to organisations outside New Zealand.

This is especially relevant to IT because cloud services and online platforms may store or process information overseas.

Organisations therefore need to understand where information is being stored and processed and whether overseas disclosure is permitted.

Principle 13 — Unique identifiers

Organisations must take care when assigning and using unique identifiers.

Unique identifiers are numbers, codes or other identifiers used to identify individuals within particular systems.

Examples can include customer numbers, employee identification numbers or other system-specific identifiers.

Privacy breaches

A privacy breach can occur when personal information is accessed, disclosed, altered, lost or destroyed without authorisation.

Organisations should have processes for responding to privacy incidents.

These processes can include:

  1. Detecting privacy incidents.

  2. Assessing the seriousness of an incident.

  3. Containing the breach.

  4. Taking steps to reduce potential harm.

  5. Notifying affected people where required.

  6. Notifying the Privacy Commissioner where required.

  7. Reviewing what happened and improving security.

A serious privacy breach can cause significant harm to individuals and organisations.

Potential consequences can include:

  • Identity theft

  • Financial loss

  • Discrimination

  • Reputational damage

  • Loss of trust

  • Personal distress

Why does the Privacy Act matter in IT?

IT professionals frequently work with systems that collect and process personal information.

Examples include:

  • Customer databases

  • Student management systems

  • Online accounts

  • E-commerce websites

  • Employee records

  • Email systems

  • Health and financial information systems

  • Cloud storage

  • Mobile applications

  • Website analytics

  • Artificial intelligence systems

Privacy should therefore be considered when designing and developing an IT system rather than being treated as an issue only after a system has been created.

Privacy and IT professionals

A responsible IT professional should ask:

  • Do we actually need to collect this information?

  • Have users been told why their information is being collected?

  • Where is the information stored?

  • Who can access it?

  • How long will it be retained?

  • Is it protected against unauthorised access?

  • Will it be shared with third parties?

  • Will information be transferred outside New Zealand?

  • Can individuals access and correct their information?

  • What happens if the system is breached?

Following these principles supports privacy-by-design and can reduce the risk of information being misused, lost or exposed.

Privacy should therefore be considered throughout the technology lifecycle rather than added only after a system has been built.

Māori Data Sovereignty

What is Māori Data Sovereignty?

Māori Data Sovereignty is the concept that Māori have rights and interests in relation to data about Māori and data that is important to Māori communities.

Te Mana Raraunga advocates for Māori authority, participation and control over Māori data and promotes the ethical use of data to support Māori wellbeing, language and culture.

Māori Data Sovereignty recognises that data is not simply a technical resource. Data can have relationships with people, communities, identity, culture and future generations.

For example, information about whakapapa, iwi affiliation or Māori communities may have significance beyond the individual person represented in a record.

Te Mana Raraunga principles

Te Mana Raraunga identifies six key principles of Māori Data Sovereignty:

Rangatiratanga — Authority

Rangatiratanga relates to authority and the ability of Māori to exercise control over Māori data and data ecosystems.

Whakapapa — Relationships

Whakapapa recognises that data has relationships, origins and context.

Understanding where data comes from and its relationship to people and communities is important when deciding how it should be collected and used.

Whanaungatanga — Obligations

Whanaungatanga recognises the relationships and obligations associated with data.

Data governance should consider the rights and interests of individuals as well as the groups and communities they belong to.

Kotahitanga — Collective benefit

Kotahitanga focuses on collective benefit.

Data should be managed in ways that can provide benefits to Māori individuals and communities rather than benefiting only the organisation collecting the information.

Manaakitanga — Reciprocity

Manaakitanga focuses on respect and reciprocity.

The collection and use of data should respect the dignity and interests of Māori individuals and communities.

Kaitiakitanga — Guardianship

Kaitiakitanga relates to guardianship.

Māori data should be protected and managed responsibly, with consideration given to its long-term impact and the interests of future generations.

Why is Māori Data Sovereignty important in IT?

For IT professionals, protecting Māori data may require consideration beyond basic technical security.

An organisation could technically secure Māori data using strong passwords, access controls and encryption while still failing to consider who has authority over the data or how it should be used.

Organisations should consider questions such as:

  • Who has authority over the data?

  • How is the data collected?

  • Why is the data being collected?

  • Where is the data stored?

  • Who decides how it is used?

  • Who benefits from the data?

  • Could the data cause harm?

  • Is the use consistent with tikanga?

  • Do Māori communities have meaningful involvement in decisions?

  • How will the data be protected for future generations?

This demonstrates that privacy, cybersecurity and Māori Data Sovereignty are related but not identical concepts.

Privacy and ethical IT

The Privacy Act provides legal requirements, but ethical IT practice goes further.

IT professionals should consider the potential consequences of their decisions for individuals and communities.

For example, an organisation may technically be able to collect large amounts of information about its users. However, collecting information simply because it is possible does not necessarily mean that it is appropriate.

Responsible IT professionals should collect information only when it is justified, protect it appropriately and be transparent about how it will be used.

Ethical IT practice therefore involves considering not only whether something is technically possible or legally permitted, but also whether it is responsible and appropriate.

Summary

The Privacy Act 2020 provides an important legal framework for protecting personal information in New Zealand.

For IT professionals, the Act affects the design, development, operation and management of digital systems.

Organisations need to carefully consider how personal information is collected, stored, accessed, used, retained and shared.

Good privacy practice requires both technical security and responsible data governance.

Māori Data Sovereignty adds an important cultural and ethical perspective by recognising Māori authority, relationships, collective interests and guardianship over Māori data.

Respecting these principles can help create digital systems that are more respectful, trustworthy and appropriate for Aotearoa New Zealand.

References

New Zealand Legislation. (2020). Privacy Act 2020.

Office of the Privacy Commissioner. (n.d.). Privacy Act 2020.

Te Mana Raraunga. (2018). Principles of Māori Data Sovereignty.