New Zealand Privacy Act 2020 compliance and requirements, so every principle holds up when someone asks.

What it is

What is the New Zealand Privacy Act 2020 and what is it used for?

The Privacy Act 2020 is New Zealand's general law on personal information. At its core sit the information privacy principles, which govern why an agency collects information about people, where it gets it from, what it tells them, how it keeps it secure and accurate, how long it holds it, and when it may use or pass it on, including outside New Zealand. Individuals can ask to see and correct what is held about them, and serious breaches must be reported.

The Office of the Privacy Commissioner is the regulator. It publishes guidance, handles complaints, receives breach notifications and can issue compliance notices; complaints can go further, to the Human Rights Review Tribunal. For a business the practical test is simple: could you explain, for any piece of personal information you hold, why you have it, who can see it and when it will be deleted? A working programme makes that answer quick and documented.

Current law. The Privacy Act 2020, Public Act 2020 No 31, received assent on 30 June 2020 and came into force on 1 December 2020, replacing the 1993 Act. The Privacy Amendment Act inserted a new principle, IPP 3A, on telling people when their information is collected from another source; it has applied since 1 May 2026. Check current wording and any codes of practice relevant to your sector with the Commissioner's guidance and your legal advisers.

Who it is for

Who needs to comply with the Privacy Act 2020?

The Act is not optional and it is not limited to large companies: businesses and organisations that operate in New Zealand and collect personal information are expected to follow it, including employers holding staff records. Organisations usually come to Sterling for a structured programme from one of four directions:

• A customer's due diligence asks how you protect their data. Enterprise and government buyers send privacy questionnaires and expect a privacy officer, documented practices and a breach process you can describe on request.
• A tender or contract carries privacy clauses. Contract terms often require you to follow the Act, report incidents quickly and control subcontractors. You need the internal routines to honour what you sign.
• A complaint, breach or enquiry from the regulator. An access request handled badly or an incident reported late exposes the gaps. A programme puts the responsibilities and records in place before the next one arrives.
• A group company or overseas parent sets one privacy standard. New Zealand entities of international groups need local practice that meets the Act as well as the group's GDPR or ISO/IEC 27701 programme.

The aim is handling of personal information that you control and can evidence. Compliance depends on how the principles are applied every day, not on a policy document alone.

Requirements

What are the main Privacy Act 2020 requirements?

The core obligations are the information privacy principles, numbered 1 to 13 with IPP 3A inserted after IPP 3, together with the duties to appoint a privacy officer and to notify serious breaches. The list below gives each principle's title as the Commissioner states it, with a short note on what it means in practice; the Act and the Commissioner's guidance give the full wording and exceptions.

• IPP 1 Purpose for collection: be clear why you need personal information before you collect it, and collect only what that purpose calls for.
• IPP 2 Source of personal information: collect it from the individual concerned, unless an exception applies.
• IPP 3 Collection directly from the individual: tell people what you are collecting, why, who will receive it and their rights.
• IPP 3A Collection from another source: when information comes from a third party, tell the individual, subject to the exceptions (since 1 May 2026).
• IPP 4 Manner of collection: collect in a way that is lawful and fair to the person concerned.
• IPP 5 Storage and security: keep personal information secure against loss, misuse and unauthorised access.
• IPP 6 and IPP 7 Access and correction: let people see the information held about them and ask for it to be corrected.
• IPP 8 Accuracy: check information is accurate, current and complete before you use or disclose it.
• IPP 9 Retention: keep it no longer than it is needed for a lawful purpose.
• IPP 10 and IPP 11 Use and disclosure: use and pass on information only for the purpose it was collected for, unless an exception applies.
• IPP 12 Disclosure outside New Zealand: meet the principle's conditions before personal information leaves New Zealand.
• IPP 13 Unique identifiers: assign and use unique identifiers only under the conditions the principle sets.
• Privacy officer and breach notification: appoint a privacy officer, and tell the Commissioner and the people affected as soon as practicable when a breach has caused or is likely to cause serious harm.

Compliance route

How do you achieve Privacy Act 2020 compliance?

There is no certificate at the end of this route. Compliance is something your organisation demonstrates, to the Commissioner if a complaint or breach arises, and to customers who ask. Sterling helps you build and run the programme; interpretation of the law in contested cases remains with your legal advisers and, ultimately, the regulator and the Tribunal.

1. 01
   Map the personal information you handle.Customers, staff, suppliers and any other individuals: what is collected, from which source, where it is stored, who receives it and whether it leaves New Zealand.
2. 02
   Gap analysis: compare current practice with the principles.Each principle, IPP 3A and the breach duty reviewed against what actually happens, with actions, owners and dates agreed.
3. 03
   Put the controls and routines in place.Appoint and brief the privacy officer, update notices, set retention rules, tighten security and access, and agree a breach response procedure.
4. 04
   Test the programme and review the results.Internal review of samples, a simulated breach or access request, and a management review that closes findings with evidence.
5. 05
   Operate, demonstrate and keep it current.Answer requests on time, record incidents, refresh training and revisit the inventory when systems, suppliers or the law change.

Check the route before you sign. No one can certify compliance with the Privacy Act 2020, so treat any offer of a "Privacy Act certificate" with suspicion. If a customer wants independent assurance, a certifiable standard such as ISO/IEC 27701 is assessed by an accredited certification body; confirm that body's accreditation under the Global ACI arrangement directly with the accreditation body concerned.

Cost

How much does Privacy Act 2020 compliance cost?

The cost of a Privacy Act programme is driven by how much personal information you hold, how many systems and suppliers touch it, and how much already works. A professional services firm with one client database needs far less than a retailer with loyalty data, marketing lists and offshore service providers. Our proposal shows each component and states everything that is included.

Timeline

How long does Privacy Act 2020 compliance take?

Timing depends on how scattered your personal information is, how quickly system owners respond and how much has to change. As an estimate, a first programme usually takes two to five months: long enough to map the information, fix the gaps and show that requests and incidents are handled the way the procedures say.

If a customer or contract has set a date, tell us at the outset and we will say plainly what can be in place by then and what should follow.

Your engagement

What your Privacy Act 2020 engagement includes

Your scope covers the full programme, from the information map to evidence that runs. Sterling does not certify, attest or validate compliance with the Act, and no certificate exists; the Office of the Privacy Commissioner regulates it, and we work alongside your legal advisers.

• Information map, gap analysis and plan

  Sources, systems, recipients and overseas flows, with actions and owners agreed.

• Policies, notices and procedures

  Privacy policy, direct and IPP 3A notices, access, retention and breach procedures, drafted from Sterling's own templates with your teams.

• Effivity ISO & GRC software

  Registers, requests and incidents managed in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your review team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal review and management review

  Sample testing, a breach exercise and findings closed with evidence.

• Privacy officer support

  Guidance for the appointed privacy officer on requests, complaints and breach decisions.

Sterling OS™ sets how we deliver. Design™ is guided support, where your team builds the programme with our consultants' direction; Drive™ is managed support, where our consultants do most of the work with your input. You choose one of the two, not both in sequence. Once the programme is operating, Sustain™ keeps reviews, training and updates on schedule, and Automate™ is Effivity, where the records live.

Compliance with the Act is overseen by the Office of the Privacy Commissioner.

Often combined with

Standards organisations pair with Privacy Act 2020 (New Zealand)

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.