Privacy Act 2020
Also known as: Information Privacy Principles, IPP
The Privacy Act 2020 is New Zealand's core privacy legislation, built around Information Privacy Principles governing how personal information is handled.
In full
The Privacy Act 2020 came into force on 1 December 2020 and applies to almost every New Zealand organisation with no small-business exemption. It is built around Information Privacy Principles governing collection, storage, use, and disclosure of personal information. Most guides still say there are thirteen; as of 1 May 2026 there are fourteen, following the Privacy Amendment Act 2025 which inserted IPP 3A requiring notification when personal information is collected indirectly rather than from the person concerned. Breaches likely to cause serious harm must be notified to the Office of the Privacy Commissioner and to affected individuals as soon as practicable.
Why it matters
If a website has a contact form, a newsletter signup, or analytics that can identify visitors, the Act applies. The practical obligations are a privacy statement describing what actually happens, reasonable security, and a plan for a breach.
A common misconception
That New Zealand requires cookie consent banners. It does not. There is no New Zealand equivalent of the European ePrivacy Directive, and the Privacy Commissioner's position is transparency rather than consent.