Our website uses cookies so we can analyse our site usage and give you the best experience. Click "Accept" if you’re happy with this, or click "More" for information about cookies on our site, how to opt out, and how to disable cookies altogether.
We respect your Do Not Track preference.
Principle 12 sets rules around sending personal information to organisations or people outside New Zealand.
Principle 12 is a new principle in the Privacy Act 2020.
A business or organisation may only disclose personal information to another organisation outside New Zealand if they check that the receiving organisation:
If none of the above criteria apply, a business or organisation may only make a cross-border disclosure with the permission of the person concerned. The person must be expressly informed that their information may not be given the same protection as provided by the New Zealand Privacy Act.
Visit our sending information overseas page for more information. You can use our decision tree to help you work out if principle 12 applies to the information you are disclosing and how to comply with it.
The goal is to make sure that the privacy protections that individuals can reasonably expect under New Zealand’s Privacy Act continue to apply when their information is disclosed and used in a different country.
Further information
Privacy Act 2020 reference
| Information privacy principle 12 | |||
| Disclosure of personal information outside New Zealand | |||
| (1) |
An agency (A) may disclose personal information to a foreign person or entity (B) in reliance on IPP 11(1)(a), (c), (e), (f), (h), or (i) only if— |
||
| (a) |
the individual concerned authorises the disclosure to B after being expressly informed by A that B may not be required to protect the information in a way that, overall, provides comparable safeguards to those in this Act; or |
||
| (b) |
B is carrying on business in New Zealand and, in relation to the information, A believes on reasonable grounds that B is subject to this Act; or |
||
| (c) |
A believes on reasonable grounds that B is subject to privacy laws that, overall, provide comparable safeguards to those in this Act; or |
||
| (d) |
A believes on reasonable grounds that B is a participant in a prescribed binding scheme; or |
||
| (e) |
A believes on reasonable grounds that B is subject to privacy laws of a prescribed country; or |
||
| (f) |
A otherwise believes on reasonable grounds that B is required to protect the information in a way that, overall, provides comparable safeguards to those in this Act (for example, pursuant to an agreement entered into between A and B). |
||
| (2) | However, subclause (1) does not apply if the personal information is to be disclosed to B in reliance on IPP 11(1)(e) or (f) and it is not reasonably practicable in the circumstances for A to comply with the requirements of subclause (1). | ||
| (3) | In this IPP,— | ||
|
prescribed binding scheme means a binding scheme specified in regulations made under section 213 |
|||
|
prescribed country means a country specified in regulations made under section 214. |
|||
