• Home /
• Privacy Act 2020

Privacy Act 2020

The Privacy Act 2020 has 13 privacy principles that govern how agencies (organisations and businesses) can collect, store, use and share personal information. All New Zealanders regardless of age or circumstance have privacy rights.

The Privacy Act makes sure that:

• you know when your information is being collected
• your information is used and shared appropriately
• your information is kept safe and secure
• you can get access to your information.

See the privacy principles in detail below

• Principle 1   - Purpose for collection
• Principle 2   - Source of information - collection from the individual
• Principle 3   - What to tell the individual about collection
• Principle 4   - Manner of collection
• Principle 5   - Storage and security of information
• Principle 6   - Providing people access to their information
• Principle 7   - Correction of personal information
• Principle 8   - Ensure accuracy before using information
• Principle 9   - Limits on retention of personal information
• Principle 10 - Use of personal information
• Principle 11 - Disclosing personal information
• Principle 12 - Disclosure outside New Zealand
• Principle 13 - Unique identifiers

Read the Privacy Act on the New Zealand legislation website.
Read the definition of what ‘personal information’ means.
Download a two-page PDF of the privacy principles (opens to PDF, 178 KB).

Codes of practice

The Privacy Act 2020 gives the Privacy Commissioner the power to issue codes of practice that become part of the law. These codes modify the operation of the Privacy Act and set rules for specific industries, organisations, or types of personal information.

Read about the Codes of Practice and what they mean. 

Case notes

We have a large archive of case notes. These are detailed records summarising the key information, progress, and actions taken in a specific case. They are a great reference for seeing how the Privacy Act has applied in various situations. The Privacy Act 2020 came into force on 1 December 2020, replacing the Privacy Act 1993.