Does the GDPR apply to my New Zealand business?
- Checked against sources
- Sources
- 4 cited
- Applies to
- New Zealand
Possibly. The GDPR can apply to a business outside the European Union if it offers goods or services to people in the EU, or monitors their behaviour there, even with no EU office. Simply having a website Europeans can visit usually isn't enough. Separately, New Zealand has EU adequacy status, which lets European organisations send personal data to New Zealand without extra safeguards.
When the GDPR reaches you
Article 3 of the GDPR sets its territorial scope. For a business with no establishment in the EU, it applies when you process personal data of people in the EU in connection with:
- offering goods or services to them, paid or free, or
- monitoring their behaviour in the EU, such as tracking them online for profiling or targeted advertising.
Signs you’re offering goods or services to people in the EU include pricing in euros, shipping to EU countries, EU-language versions of your site, or marketing aimed at EU customers. A New Zealand café whose website happens to be visible in France isn’t caught. A New Zealand software company selling subscriptions to customers in Germany probably is.
If the GDPR applies, you may also need to appoint a representative in the EU, among other obligations. Get advice if you’re unsure.
What New Zealand’s adequacy status means
The European Commission has recognised New Zealand as providing an adequate level of data protection. That means organisations in the EU can send personal data to New Zealand without extra contractual safeguards. It doesn’t mean New Zealand businesses are automatically GDPR-compliant, and it doesn’t switch off the GDPR for businesses that fall under Article 3.
The Ministry of Justice has said one aim of the Privacy Amendment Act 2025, which added the indirect collection rule (IPP 3A), was to support New Zealand keeping its adequacy status.
Practical approach for NZ businesses with EU customers
- Comply with the Privacy Act 2020 first. It’s your baseline.
- If you’re caught by Article 3, map the extra GDPR obligations, such as lawful bases for processing, the right to erasure, data protection impact assessments for high-risk processing, breach notification within 72 hours to the relevant authority, and an EU representative.
- Many businesses apply the stricter standard to everyone, because running two regimes is harder than running one.
Also check
The UK has its own version of the GDPR with similar territorial rules. Australia’s Privacy Act can apply to New Zealand businesses with an Australian link. If you sell internationally, check each market.
Sources
Something wrong or out of date? Tell us or edit this page on GitHub. General information, not legal advice.