{"id":15,"date":"2026-08-31T21:12:59","date_gmt":"2026-08-31T21:12:59","guid":{"rendered":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/?page_id=15"},"modified":"2026-09-05T22:34:15","modified_gmt":"2026-09-05T22:34:15","slug":"privacy-act-2020","status":"publish","type":"page","link":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/?page_id=15","title":{"rendered":"Privacy Act 2020"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n \t\t
\n\t\t\t\t\t\t\t\t\t

Privacy Act 2020<\/h1>

Protecting Personal Information in New Zealand<\/h2>

The Privacy Act 2020 is New Zealand’s main law governing how organisations collect, store, use and disclose personal information.<\/p>

The Act gives people privacy rights and establishes rules that organisations must follow when handling personal information.<\/p>

This is particularly important in Information Technology because modern organisations collect and process large amounts of information through websites, applications, databases, cloud services and other digital systems.<\/p>

The Privacy Act came into force on 1 December 2020<\/strong> and replaced the Privacy Act 1993.<\/p>

The Act applies to organisations across New Zealand, including businesses, government agencies, schools and other organisations that collect or process personal information.<\/p>

The Act is administered by the Office of the Privacy Commissioner.<\/p>

What is personal information?<\/h2>

Personal information is information that relates to an identifiable individual.<\/p>

Examples can include:<\/p>

  • Names<\/p><\/li>

  • Contact details<\/p><\/li>

  • Login information<\/p><\/li>

  • Financial information<\/p><\/li>

  • Customer records<\/p><\/li>

  • Employee records<\/p><\/li>

  • Student records<\/p><\/li>

  • Health information<\/p><\/li>

  • Online account information<\/p><\/li>

  • Other information that can identify an individual<\/p><\/li><\/ul>

    IT systems routinely collect, process and store this type of information, meaning IT professionals have an important role in protecting it.<\/p>

    The Information Privacy Principles<\/h2>

    The Privacy Act contains Information Privacy Principles (IPPs). These principles provide rules for how agencies should collect, store, use and disclose personal information.<\/p>

    Principle 1 \u2014 Purpose of collection<\/h3>

    Personal information should only be collected for a lawful purpose connected with the functions or activities of an organisation.<\/p>

    The information collected should also be necessary for that purpose.<\/p>

    For example, an online retailer may need a customer’s name and delivery address to deliver an order. It would not normally need unrelated personal information simply because its software could collect it.<\/p>

    Principle 2 \u2014 Source of information<\/h3>

    Personal information should generally be collected directly from the individual concerned, unless an exception applies.<\/p>

    This helps people understand who is collecting their information and why it is being collected.<\/p>

    Principle 3 \u2014 Information collected directly from an individual<\/h3>

    When personal information is collected directly from an individual, the organisation generally needs to provide information about the collection.<\/p>

    This can include:<\/p>

    • The fact that information is being collected.<\/p><\/li>

    • Why the information is being collected.<\/p><\/li>

    • Who is expected to receive it.<\/p><\/li>

    • Who is collecting and holding it.<\/p><\/li>

    • Whether providing the information is required or voluntary.<\/p><\/li>

    • The individual’s rights to access and correct their information.<\/p><\/li><\/ul>

      Principle 3A \u2014 Information collected indirectly<\/h3>

      Information Privacy Principle 3A is a newer privacy requirement that came into effect in May 2026<\/strong>.<\/p>

      It applies when an organisation collects personal information about an individual from someone or somewhere other than the individual themselves.<\/p>

      In these circumstances, organisations may need to take reasonable steps to make the individual aware that their information has been collected, why it was collected, who will receive it and their rights to access and correct the information.<\/p>

      This is particularly relevant to modern IT systems that combine information from different databases, organisations and third-party providers.<\/p>

      Principle 4 \u2014 Manner of collection<\/h3>

      Personal information must not be collected using unlawful, unfair or unnecessarily intrusive methods.<\/p>

      Organisations should collect information in a way that respects an individual’s personal affairs.<\/p>

      For example, an organisation should not secretly collect excessive information about users simply because its technology allows it to do so.<\/p>

      Principle 5 \u2014 Storage and security<\/h3>

      Organisations must take reasonable steps to protect personal information against:<\/p>

      • Loss<\/p><\/li>

      • Unauthorised access<\/p><\/li>

      • Unauthorised use<\/p><\/li>

      • Unauthorised modification<\/p><\/li>

      • Unauthorised disclosure<\/p><\/li>

      • Other forms of misuse<\/p><\/li><\/ul>

        This is highly relevant to IT professionals because digital systems must be designed and maintained to protect the information they hold.<\/p>

        Technical measures that can help protect information include:<\/p>

        • Strong passwords<\/p><\/li>

        • Multi-factor authentication<\/p><\/li>

        • Access controls<\/p><\/li>

        • Encryption<\/p><\/li>

        • Secure backups<\/p><\/li>

        • Firewalls<\/p><\/li>

        • Software updates<\/p><\/li>

        • Security monitoring<\/p><\/li>

        • Secure disposal of data<\/p><\/li><\/ul>

          Principle 6 \u2014 Access<\/h3>

          Individuals generally have the right to access personal information that an organisation holds about them.<\/p>

          IT systems should therefore allow organisations to locate and retrieve personal information when a valid access request is made.<\/p>

          Principle 7 \u2014 Correction<\/h3>

          Individuals can request correction of personal information that an organisation holds about them.<\/p>

          If information is inaccurate, incomplete or misleading, organisations should provide an appropriate process for individuals to request corrections.<\/p>

          IT systems should therefore support appropriate processes for updating inaccurate records.<\/p>

          Principle 8 \u2014 Accuracy<\/h3>

          Before using or disclosing personal information, organisations should take reasonable steps to ensure that the information is:<\/p>

          • Accurate<\/p><\/li>

          • Complete<\/p><\/li>

          • Relevant<\/p><\/li>

          • Up to date<\/p><\/li>

          • Not misleading<\/p><\/li><\/ul>

            Incorrect information can result in incorrect decisions and potentially cause harm to individuals.<\/p>

            Principle 9 \u2014 Retention<\/h3>

            Personal information should not be kept for longer than is required for the purposes for which it may lawfully be used.<\/p>

            IT professionals should therefore consider data-retention policies and secure deletion rather than keeping personal information indefinitely.<\/p>

            Principle 10 \u2014 Use<\/h3>

            Personal information should generally only be used for the purpose for which it was collected, unless an exception applies.<\/p>

            For example, information collected to provide a particular service should not automatically be reused for an unrelated purpose.<\/p>

            Principle 11 \u2014 Disclosure<\/h3>

            Personal information should generally only be disclosed for the purpose for which it was collected or where another permitted situation applies.<\/p>

            This is particularly important when organisations use:<\/p>

            • Cloud providers<\/p><\/li>

            • Marketing platforms<\/p><\/li>

            • Analytics services<\/p><\/li>

            • External contractors<\/p><\/li>

            • Software-as-a-Service platforms<\/p><\/li>

            • Third-party applications<\/p><\/li><\/ul>

              Organisations need to understand what information is being shared, who it is being shared with and whether the disclosure is permitted.<\/p>

              Principle 12 \u2014 Disclosure outside New Zealand<\/h3>

              The Privacy Act contains additional requirements when personal information is disclosed to organisations outside New Zealand.<\/p>

              This is especially relevant to IT because cloud services and online platforms may store or process information overseas.<\/p>

              Organisations therefore need to understand where information is being stored and processed and whether overseas disclosure is permitted.<\/p>

              Principle 13 \u2014 Unique identifiers<\/h3>

              Organisations must take care when assigning and using unique identifiers.<\/p>

              Unique identifiers are numbers, codes or other identifiers used to identify individuals within particular systems.<\/p>

              Examples can include customer numbers, employee identification numbers or other system-specific identifiers.<\/p>

              Privacy breaches<\/h2>

              A privacy breach can occur when personal information is accessed, disclosed, altered, lost or destroyed without authorisation.<\/p>

              Organisations should have processes for responding to privacy incidents.<\/p>

              These processes can include:<\/p>

              1. Detecting privacy incidents.<\/p><\/li>

              2. Assessing the seriousness of an incident.<\/p><\/li>

              3. Containing the breach.<\/p><\/li>

              4. Taking steps to reduce potential harm.<\/p><\/li>

              5. Notifying affected people where required.<\/p><\/li>

              6. Notifying the Privacy Commissioner where required.<\/p><\/li>

              7. Reviewing what happened and improving security.<\/p><\/li><\/ol>

                A serious privacy breach can cause significant harm to individuals and organisations.<\/p>

                Potential consequences can include:<\/p>

                • Identity theft<\/p><\/li>

                • Financial loss<\/p><\/li>

                • Discrimination<\/p><\/li>

                • Reputational damage<\/p><\/li>

                • Loss of trust<\/p><\/li>

                • Personal distress<\/p><\/li><\/ul>

                  Why does the Privacy Act matter in IT?<\/h2>

                  IT professionals frequently work with systems that collect and process personal information.<\/p>

                  Examples include:<\/p>

                  • Customer databases<\/p><\/li>

                  • Student management systems<\/p><\/li>

                  • Online accounts<\/p><\/li>

                  • E-commerce websites<\/p><\/li>

                  • Employee records<\/p><\/li>

                  • Email systems<\/p><\/li>

                  • Health and financial information systems<\/p><\/li>

                  • Cloud storage<\/p><\/li>

                  • Mobile applications<\/p><\/li>

                  • Website analytics<\/p><\/li>

                  • Artificial intelligence systems<\/p><\/li><\/ul>

                    Privacy should therefore be considered when designing and developing an IT system rather than being treated as an issue only after a system has been created.<\/p>

                    Privacy and IT professionals<\/h2>

                    A responsible IT professional should ask:<\/p>

                    • Do we actually need to collect this information?<\/p><\/li>

                    • Have users been told why their information is being collected?<\/p><\/li>

                    • Where is the information stored?<\/p><\/li>

                    • Who can access it?<\/p><\/li>

                    • How long will it be retained?<\/p><\/li>

                    • Is it protected against unauthorised access?<\/p><\/li>

                    • Will it be shared with third parties?<\/p><\/li>

                    • Will information be transferred outside New Zealand?<\/p><\/li>

                    • Can individuals access and correct their information?<\/p><\/li>

                    • What happens if the system is breached?<\/p><\/li><\/ul>

                      Following these principles supports privacy-by-design<\/strong> and can reduce the risk of information being misused, lost or exposed.<\/p>

                      Privacy should therefore be considered throughout the technology lifecycle rather than added only after a system has been built.<\/p>

                      M\u0101ori Data Sovereignty<\/h1>

                      What is M\u0101ori Data Sovereignty?<\/h2>

                      M\u0101ori Data Sovereignty is the concept that M\u0101ori have rights and interests in relation to data about M\u0101ori and data that is important to M\u0101ori communities.<\/p>

                      Te Mana Raraunga advocates for M\u0101ori authority, participation and control over M\u0101ori data and promotes the ethical use of data to support M\u0101ori wellbeing, language and culture.<\/p>

                      M\u0101ori Data Sovereignty recognises that data is not simply a technical resource. Data can have relationships with people, communities, identity, culture and future generations.<\/p>

                      For example, information about whakapapa, iwi affiliation or M\u0101ori communities may have significance beyond the individual person represented in a record.<\/p>

                      Te Mana Raraunga principles<\/h2>

                      Te Mana Raraunga identifies six key principles of M\u0101ori Data Sovereignty:<\/p>

                      Rangatiratanga \u2014 Authority<\/h3>

                      Rangatiratanga relates to authority and the ability of M\u0101ori to exercise control over M\u0101ori data and data ecosystems.<\/p>

                      Whakapapa \u2014 Relationships<\/h3>

                      Whakapapa recognises that data has relationships, origins and context.<\/p>

                      Understanding where data comes from and its relationship to people and communities is important when deciding how it should be collected and used.<\/p>

                      Whanaungatanga \u2014 Obligations<\/h3>

                      Whanaungatanga recognises the relationships and obligations associated with data.<\/p>

                      Data governance should consider the rights and interests of individuals as well as the groups and communities they belong to.<\/p>

                      Kotahitanga \u2014 Collective benefit<\/h3>

                      Kotahitanga focuses on collective benefit.<\/p>

                      Data should be managed in ways that can provide benefits to M\u0101ori individuals and communities rather than benefiting only the organisation collecting the information.<\/p>

                      Manaakitanga \u2014 Reciprocity<\/h3>

                      Manaakitanga focuses on respect and reciprocity.<\/p>

                      The collection and use of data should respect the dignity and interests of M\u0101ori individuals and communities.<\/p>

                      Kaitiakitanga \u2014 Guardianship<\/h3>

                      Kaitiakitanga relates to guardianship.<\/p>

                      M\u0101ori data should be protected and managed responsibly, with consideration given to its long-term impact and the interests of future generations.<\/p>

                      Why is M\u0101ori Data Sovereignty important in IT?<\/h2>

                      For IT professionals, protecting M\u0101ori data may require consideration beyond basic technical security.<\/p>

                      An organisation could technically secure M\u0101ori data using strong passwords, access controls and encryption while still failing to consider who has authority over the data or how it should be used.<\/p>

                      Organisations should consider questions such as:<\/p>

                      • Who has authority over the data?<\/p><\/li>

                      • How is the data collected?<\/p><\/li>

                      • Why is the data being collected?<\/p><\/li>

                      • Where is the data stored?<\/p><\/li>

                      • Who decides how it is used?<\/p><\/li>

                      • Who benefits from the data?<\/p><\/li>

                      • Could the data cause harm?<\/p><\/li>

                      • Is the use consistent with tikanga?<\/p><\/li>

                      • Do M\u0101ori communities have meaningful involvement in decisions?<\/p><\/li>

                      • How will the data be protected for future generations?<\/p><\/li><\/ul>

                        This demonstrates that privacy, cybersecurity and M\u0101ori Data Sovereignty are related but not identical concepts.<\/p>

                        Privacy and ethical IT<\/h2>

                        The Privacy Act provides legal requirements, but ethical IT practice goes further.<\/p>

                        IT professionals should consider the potential consequences of their decisions for individuals and communities.<\/p>

                        For example, an organisation may technically be able to collect large amounts of information about its users. However, collecting information simply because it is possible does not necessarily mean that it is appropriate.<\/p>

                        Responsible IT professionals should collect information only when it is justified, protect it appropriately and be transparent about how it will be used.<\/p>

                        Ethical IT practice therefore involves considering not only whether something is technically possible or legally permitted, but also whether it is responsible and appropriate.<\/p>

                        Summary<\/h2>

                        The Privacy Act 2020 provides an important legal framework for protecting personal information in New Zealand.<\/p>

                        For IT professionals, the Act affects the design, development, operation and management of digital systems.<\/p>

                        Organisations need to carefully consider how personal information is collected, stored, accessed, used, retained and shared.<\/p>

                        Good privacy practice requires both technical security and responsible data governance.<\/p>

                        M\u0101ori Data Sovereignty adds an important cultural and ethical perspective by recognising M\u0101ori authority, relationships, collective interests and guardianship over M\u0101ori data.<\/p>

                        Respecting these principles can help create digital systems that are more respectful, trustworthy and appropriate for Aotearoa New Zealand.<\/p>

                        References<\/h2>

                        New Zealand Legislation. (2020). Privacy Act 2020<\/em>.<\/p>

                        Office of the Privacy Commissioner. (n.d.). Privacy Act 2020<\/em>.<\/p>

                        Te Mana Raraunga. (2018). Principles of M\u0101ori Data Sovereignty<\/em>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\n<\/div>\n

                        \n \t\t
                        \n\t\t\t\t\t\t\t
                        \n\t\t\t
                        <\/div>\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\n<\/div>\n\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

                        Privacy Act 2020 Protecting Personal Information in New Zealand The Privacy Act 2020 is New Zealand’s main law governing how organisations collect, store, use and disclose personal information. The Act gives people privacy rights and establishes rules that organisations must follow when handling personal information. This is particularly important in Information Technology because modern organisations […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-15","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/index.php?rest_route=\/wp\/v2\/pages\/15","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=15"}],"version-history":[{"count":13,"href":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/index.php?rest_route=\/wp\/v2\/pages\/15\/revisions"}],"predecessor-version":[{"id":270,"href":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/index.php?rest_route=\/wp\/v2\/pages\/15\/revisions\/270"}],"wp:attachment":[{"href":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}