Suppliers, cloud services and sending information overseas

Almost every New Zealand organisation keeps personal information with someone else, whether for email and file storage, payroll, CRM, booking systems, cloud backups or IT support. The Privacy Act has two rules that decide who is responsible and when sending information overseas is allowed.

Section 11: information held for you is yours

If a supplier holds or processes personal information only on your behalf, and doesn’t use or disclose it for its own purposes, section 11 treats the information as held by you. Two consequences:

• You remain responsible. If the supplier is breached, it’s your breach too. You must assess it and, if notifiable, notify the Commissioner and affected people.
• It isn’t a disclosure. Putting information into a cloud service that only holds it for you doesn’t count as disclosing it, so IPP 11 and IPP 12 don’t apply to that transfer. The supplier isn’t an indirect collector under IPP 3A either.

The moment a supplier uses the information for its own purposes, such as training its own products, building profiles or selling insights, section 11 no longer protects you. That’s a disclosure, and the supplier becomes responsible as an agency in its own right. Read the terms carefully, particularly for free tools and AI services.

IPP 12: sending information overseas

If you disclose personal information to a foreign person or organisation (not one acting only on your behalf), IPP 12 says you can only do so if one of these applies:

• the person authorises it, after you’ve told them the recipient may not protect it in a way comparable to New Zealand law
• the recipient carries on business in New Zealand and is subject to the Privacy Act
• the recipient is subject to privacy laws that, overall, provide comparable safeguards
• the recipient is bound by a binding scheme or is in a country prescribed by regulation
• you’ve otherwise ensured comparable safeguards, for example by contract

The Commissioner provides model contract clauses for overseas disclosures. Check its guidance on sending information overseas.

Choosing a supplier

Ask before you sign. Our supplier privacy questionnaire covers the questions that matter, including:

• Where will the data be stored and processed, and by which sub-processors?
• Will you use our data for any purpose of your own, including training AI models?
• What security certifications and controls do you have? Is multi-factor authentication enforced?
• How quickly will you tell us about a breach, and what information will you give us?
• How do we get our data back, and how do you delete it, when we leave?
• Can you help us respond to access and correction requests within 20 working days?

What to put in the contract

• The supplier acts only on your instructions and doesn’t use the data for its own purposes.
• Security requirements appropriate to the data.
• Breach notification to you within a short, fixed time (24 to 48 hours is common), with enough detail for you to assess and notify.
• Restrictions on sub-processors and overseas transfers, and notice of changes.
• Help with access and correction requests.
• Return and deletion at the end, with confirmation.
• Your right to audit or receive assurance reports.

The Manage My Health lesson for supply chains

In its 2026 inquiry into the Manage My Health breach, the Commissioner found that Health NZ, which was not the portal operator, had also breached its obligations, and recommended that it strengthen its management of third-party suppliers. If you rely on a supplier to hold sensitive information, the regulator will look at what you did to check and manage that supplier, as well as at the supplier itself.

Keep a register

List each supplier that holds personal information, what it holds, where, the contract date, and when you last reviewed it. Add it to your personal information inventory.