New Zealand Privacy Act
Privacy Act 2020, as amended by the Privacy Amendment Act 2025
Key Facts
Overview
New Zealand's Privacy Act takes a notably less prescriptive approach to cookies than EU-style laws. There is no mandatory opt-in cookie consent requirement. Instead, transparency and opt-out mechanisms are the primary requirements. New Zealand holds an EU adequacy decision, recognizing its data protection as adequate for EU transfers.
What This Means for Your Website
- No mandatory opt-in cookie consent is required (unlike GDPR)
- Organizations must be transparent about cookie use and provide opt-out mechanisms
- Consent IS required for targeted advertising involving cookies
- Mandatory breach notification applies for serious privacy breaches
- The 2025 Amendment adds transparency obligations for data collected from third parties (IPP 3A)
- Penalties are low: NZD 10,000-50,000
Key Requirements
The OPC enforces the Privacy Act built around 13 Information Privacy Principles. Penalties reach NZD 50,000 for organizations. The Human Rights Review Tribunal can award damages in breach cases. Consumer requests must be fulfilled within 20 working days.
How ConsentStack Handles This
ConsentStack applies New Zealand's transparency and opt-out model for NZ visitors, with targeted advertising consent where required.
Penalties
Individuals: up to NZD 10,000. Organizations: up to NZD 50,000. Human Rights Review Tribunal can award damages.
Key Requirements
- 13 Information Privacy Principles governing personal information
- Transparency required about cookie use and data collection purposes
- Opt-out mechanisms must be provided for tracking
- Consent required for targeted advertising
- Mandatory breach notification for serious privacy breaches
- New IPP 3A (2025): transparency for data collected from third parties
Notable Provisions
- No mandatory opt-in cookie consent, less prescriptive than GDPR
- EU adequacy decision in force
- Low penalties by international standards
- 2025 Amendment adds third-party collection transparency (IPP 3A)
Data Subject Rights
Deal with an agency without giving your identifying information when the lawful purpose for which it collects personal information about you does not require it.
Ask an agency to confirm whether it holds personal information about you and to give you access to it; it must respond as soon as reasonably practicable and within 20 working days, extendable for a reasonable period by notice, and a private sector agency may charge a reasonable fee for providing it.
Ask an agency to correct your personal information, or to attach your statement of correction if it will not; it must decide a correction request and tell you within 20 working days, extendable for a reasonable period by notice, and so far as reasonably practicable tell others it disclosed the information to.
Have your representative make an access or correction request to an agency on your behalf; a complaint to the Privacy Commissioner may also be made on your behalf.
Complain to the Privacy Commissioner, orally or in writing, that an agency's action is or appears to be an interference with your privacy; the Commissioner may decline if you have not first tried to resolve it with the agency, and some outcomes let you take proceedings to the Human Rights Review Tribunal.
Other Asia Pacific Regulations
Frequently Asked Questions
Stay compliant with New Zealand Privacy Act
ConsentStack helps you implement Opt-out consent for New Zealand automatically.