Insights

/

Consumer Markets

Privacy in New Zealand: what counts as personal information and common misconceptions

by: Danita Ferreira, Partner

22 October 2026

Print Insight Download Insight as PDF

Subscribe to our insights


 

Disclaimer

The information in these articles is general information only, is provided free of charge and does not constitute legal or other professional advice. We try to keep the information up to date. However, to the fullest extent permitted by law, we disclaim all warranties, express or implied, in relation to this article – including (without limitation) warranties as to accuracy, completeness and fitness for any particular purpose. Please seek independent advice before acting on any information in this article.

Privacy obligations are often misunderstood or overlooked, particularly by businesses that assume they are too small to be affected or that basic privacy measures are enough. In reality, everyday activities such as collecting customer contact details, maintaining employee records or managing online bookings can trigger obligations under New Zealand’s Privacy Act 2020 (Privacy Act).

Understanding what constitutes personal information, how it can lawfully be used and the steps required to protect it is essential for businesses of all sizes. We explore some common misconceptions about privacy compliance and what New Zealand businesses need to know to meet their obligations and minimise legal risk.

What counts as personal information?

Personal information is any information relating to an identifiable individual. An individual does not need to be named directly if their identity can still be established from the information or other available details.

Names and contact details, and identification details such as a driver’s licence, financial information, employment records and health information are examples of personal information that most businesses will readily recognise.

There are, however, other types of information that businesses may not immediately consider “personal information” including website and digital data, customer preferences and behaviour, biometric information, location/access records, CCTV and call recordings.

Removing a person’s name does not necessarily make information anonymous. For example, a report about the only employee working a particular shift may still identify that individual, even if their name is omitted. usinesses should therefore look beyond obvious identifiers and consider whether the information they hold relates to someone who can be reasonably identified.

What are some common privacy misconceptions?

MythWhat you need to know
Small businesses do not need to comply with privacy laws.The Privacy Act applies to businesses of all sizes that collect or hold personal information, including sole traders and small businesses. This means that having a low turnover, few employees or a limited customer base does not automatically exempt a New Zealand business from its privacy obligations.

The only parties excluded from the Privacy Act in New Zealand are Members of Parliament, courts and tribunals in relation to their judicial functions, and news media when they are conducting their news activities.
Outsourcing data processing means your business is no longer responsible for privacy.Under the Privacy Act, when a third-party provider holds or processes personal information solely on your business's behalf, your business generally remains responsible for that information under the Privacy Act.
For example, using an external payroll provider or cloud storage service does not remove your responsibility to protect the personal information.

However, if the provider uses or discloses the information for its own purposes as well, both parties will likely have privacy obligations under the Privacy Act.

Businesses should therefore understand how their third-party providers handle personal information and ensure appropriate safeguards and contractual arrangements are in place.
You only need to report a privacy breach if a large amount of information is exposed.The seriousness of a privacy breach is not determined by the number of people or records affected but rather, whether the breach caused “serious harm”. Examples of serious harm may include financial harm, identify theft, physical harm, emotional harm and reputational harm. This means that a breach of one individual may still be notifiable if it has, or is likely to, cause serious harm.

Where a breach is notifiable, businesses must notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, usually within 72 hours of becoming aware that the breach is notifiable.
If a customer consents, you can use their personal information however you like.Under the Privacy Act, businesses must generally only use the personal information for the purpose(s) for which it was collected. For example, collecting a customer's email address to manage a booking does not automatically allow you to use it for unrelated marketing campaigns or share it with another business for its own purposes.

If a business wants to use personal information for a new purpose, it must consider whether that use is permitted under the Privacy Act, including whether the individual has been made aware of the relevant purpose and whether an applicable exception allows the use. Simply obtaining consent at the point of initial collection does not provide unlimited permission to use the personal information in any way.
Having a privacy policy means the business is compliant.Having a privacy policy is only part of meeting your privacy obligations. Businesses must ensure their actual practices align with what their policy says.

A privacy policy should not be a document that is created once and forgotten. It needs to be reviewed regularly and updated whenever business practices or relevant legal requirements change. A policy that has not been reviewed for several years may no longer accurately reflect how your business handles personal information.

Businesses should also have appropriate internal privacy policies and procedures to guide staff on handling personal information, restricting access, protecting records and responding to privacy breaches.

 

Are you complying with your indirect collection obligations?

Finally, we wanted to take this opportunity to remind businesses that the information privacy principle 3A (IPP3A) came into force on 1 May 2026, introducing new requirements for businesses that collect personal information indirectly (that is, from someone other than the individual concerned). If you have not already considered how the IPP3A may affect your business, we recommend doing so as soon as possible to ensure you are meeting your new obligations.

We can help

Privacy obligations apply to businesses of all sizes, and getting compliance wrong can create significant legal and reputational risks. The team at Wynn Williams can help your business to understand its obligations under the Privacy Act, review its privacy policies and procedures, and manage privacy risks.

 

Danita Ferreira, Partner – Wynn Williams Consumer Markets team

Roxana Cvasniuc, Associate – Wynn Williams Consumer Markets team

Disclaimer

The information in these articles is general information only, is provided free of charge and does not constitute legal or other professional advice. We try to keep the information up to date. However, to the fullest extent permitted by law, we disclaim all warranties, express or implied, in relation to this article – including (without limitation) warranties as to accuracy, completeness and fitness for any particular purpose. Please seek independent advice before acting on any information in this article.

Print Insight Download Insight as PDF

Subscribe to our insights


 

Wynn Williams Logo

WWW.WYNNWILLIAMS.CO.NZ