The Privacy Act 2020 in plain language

The Privacy Act 2020 is principles-based. It sets out principles and expects you to apply them sensibly to what you do. There’s no list of approved technologies and no fixed retention period for your files. That makes it flexible, and it also means you have to think.

Who it applies to

Almost everyone that handles information about identifiable people, including companies, sole traders, charities, clubs, schools, iwi organisations, churches, government departments and councils. The Act calls them all “agencies”. It also applies to overseas organisations carrying on business in New Zealand, even if they have no office here.

Personal information means information about an identifiable individual. It includes opinions about someone, images and recordings, and information that identifies someone when combined with other information you hold. It doesn’t need to be secret or sensitive.

The fourteen principles

There were thirteen. The Privacy Amendment Act 2025 added principle 3A, in force from 1 May 2026, so you’ll still see “the 13 IPPs” in older material.

Principle	What it asks	What it looks like in practice
1. Purpose	Only collect personal information you need for a lawful purpose connected to what you do.	Don’t ask for date of birth on a newsletter sign-up.
2. Source	Collect it from the person, unless an exception applies.	Ask the job applicant. Check with a former colleague only if the applicant agrees, for example as a referee.
3. Telling people (direct)	When you collect from someone, tell them why, who will get it, whether it’s required, and their rights.	A short notice on the form, with a link to your full privacy statement.
3A. Telling people (indirect)	When you collect from someone else, take reasonable steps to tell the person the same things, unless an exception applies.	Your privacy statement covers referees and credit checks, and you can show the person saw it. See our IPP 3A guide.
4. Manner	Collect it lawfully, fairly and without unreasonable intrusion. Take particular care with children and young people.	No hidden cameras in changing rooms. No pressure tactics.
5. Security	Protect it against loss, misuse and unauthorised access, with safeguards that fit the sensitivity.	Multi-factor authentication, access limited by role, encrypted laptops, a process for leavers.
6. Access	People can ask for the information you hold about them. Respond within 20 working days.	A logged request process. See responding to access requests.
7. Correction	People can ask you to correct it. If you won’t, attach their statement of correction if asked.	A process to fix records and tell anyone you shared the wrong information with.
8. Accuracy	Check it’s accurate, up to date, complete and relevant before you use it.	Confirm details before sending sensitive letters.
9. Retention	Don’t keep it longer than you need it for a lawful purpose.	A retention schedule you actually run. See our retention schedule template.
10. Use	Use it only for the purpose you collected it for, unless an exception applies.	Don’t add customers’ emails to marketing lists if they gave them for delivery updates.
11. Disclosure	Don’t disclose it unless an exception applies, such as the person authorising it or a serious threat.	Know when you can share with Police and when they need a warrant or production order.
12. Overseas disclosure	Only send it overseas where the recipient is bound by comparable safeguards, or the person authorises it after being told the risks, or another exception applies.	Contract terms with overseas suppliers. Cloud storage on your behalf is treated differently. See suppliers and overseas.
13. Unique identifiers	Don’t assign someone the same unique identifier another agency uses, and protect identifiers from misuse.	Don’t use IRD or driver licence numbers as your customer numbers.

Breaches of the principles are dealt with mainly through complaints to the Privacy Commissioner, and from there the Human Rights Review Tribunal, rather than by suing you directly in the ordinary courts.

Codes of practice

Some sectors have their own rules that replace or modify the principles. The current codes include the Health Information Privacy Code 2020, the Credit Reporting Privacy Code 2020, the Telecommunications Information Privacy Code 2020 and the Biometric Processing Privacy Code 2025. If you’re in one of these sectors, start with the code, because it changes how the principles apply to you.

Things you must have

A privacy officer. Every agency must have one, and they can be someone outside the organisation. Their job is to encourage compliance, deal with requests and work with the Commissioner. See our privacy officer role description.
A way to respond to requests within 20 working days.
A way to recognise, assess and notify serious breaches. A notifiable breach must be reported to the Commissioner and to affected people as soon as practicable. See breach response.

What the Commissioner can do

Investigate complaints and try to settle them.
Run inquiries into matters of public interest, as it did into the Manage My Health breach in 2026.
Issue compliance notices requiring you to do something, or stop doing something, to comply.
Issue access directions requiring you to release information to someone.
Refer cases to the Director of Human Rights Proceedings, who can take them to the Human Rights Review Tribunal. The Tribunal can award damages.
Prosecute some offences, including failing to notify a notifiable breach, with fines of up to $10,000.

The Act doesn’t have large administrative fines like Europe’s GDPR. The Commissioner has said repeatedly that it should. Don’t read the absence of big fines as low risk. Tribunal damages, compliance notices, public naming and the cost of a breach are all real.

What the Commissioner expects

The Commissioner’s Poupou Matatapu guidance sets out what good privacy practice looks like across ten pou, and the Commissioner has said it will consider whether you’ve worked towards those outcomes when deciding on compliance action. Our privacy self-check is organised the same way. Start there.