Does my New Zealand business need a privacy policy?

What the law actually requires

When you collect personal information from someone, principle 3 says you must take reasonable steps to make sure they know:

• that you’re collecting it
• why
• who will receive it
• your organisation’s name and address
• whether it’s required by law, and what happens if they don’t provide it
• their right to access and correct it

Since 1 May 2026, principle 3A applies similar duties when you collect information about someone from someone else, such as referees, credit reporters or partner businesses.

You also need a privacy officer, and a way to respond to access and correction requests within 20 working days.

Statement, notice or policy?

People use these words loosely. A useful distinction:

• Privacy statement: public, explains what you do with personal information. Usually on your website. This is what most people mean by “privacy policy”.
• Collection notice: short, at the point of collection, such as on a form.
• Internal privacy policy: rules for your staff about handling personal information.

A small business needs the first two. Larger organisations should have all three.

What a good statement covers

What you collect from people, what you collect from others, why, who you share it with, whether it goes overseas, how you protect it, how long you keep it, and how people can access, correct or complain. Our privacy statement template has all of these, including the indirect collection section most older statements lack. The Privacy Commissioner also offers a free Privacy Statement Generator.

Mistakes to avoid

• Copying another company’s policy. It won’t describe what you do, and the Act requires accuracy.
• Copying a GDPR or US policy. It will cite the wrong law and miss New Zealand requirements.
• Vague purposes like “for business purposes”. The Commissioner’s guidance is that this isn’t specific enough.
• Forgetting third-party tools such as analytics, payment providers and email platforms.
• Never updating it.