• Home /
• Privacy Act 2020

Privacy Act 2020

The Privacy Act 2020 has a set of principles that govern how agencies (organisations and businesses) can collect, store, use and share personal information. All New Zealanders regardless of age or circumstance have privacy rights.

The Privacy Act makes sure that:

• you know when your information is being collected
• your information is used and shared appropriately
• your information is kept safe and secure
• you can get access to your information.

The Privacy Amendment Act 2025 brought into force information privacy principle (IPP) 3A from 1 May 2026, adding to the Privacy Act’s set of 13 IPPs. IPP3A is a new notification obligation, covering the collection of personal information other than from the individual concerned (that is, indirect collection). It sits alongside the existing notification obligation IPP3, covering collection of information from the individual concerned. To avoid any confusion, the set of IPPs is still numbered 1-13 with new IPP 3A being inserted to follow IPP3. We will be gradually updating our website content as resources allow to reflect this change. We have guidance on the new IPP3A. A number of codes of practice have also been amended following consultation to include new rule 3A.

See the privacy principles in detail below

• Principle 1   - Purpose for collection
• Principle 2   - Source of information - collection from the individual
• Principle 3   - what to tell the individual when you collect their information directly
• Principle 3A - What to tell the individual when you collect their information from another source
• Principle 4   - Manner of collection
• Principle 5   - Storage and security of information
• Principle 6   - Providing people access to their information
• Principle 7   - Correction of personal information
• Principle 8   - Ensure accuracy before using information
• Principle 9   - Limits on retention of personal information
• Principle 10 - Use of personal information
• Principle 11 - Disclosing personal information
• Principle 12 - Disclosure outside New Zealand
• Principle 13 - Unique identifiers

Read the Privacy Act on the New Zealand legislation website.

Read the definition of what ‘personal information’ means.

IPP3A came into effect in May 2026. Read our guidance on this new principle.

Download a two-page PDF of the privacy principles (opens to PDF, 178 KB).

Codes of practice

The Privacy Act 2020 gives the Privacy Commissioner the power to issue codes of practice that become part of the law. These codes modify the operation of the Privacy Act and set rules for specific industries, organisations, or types of personal information.

Read about the Codes of Practice and what they mean. 

Case notes

We have a large archive of case notes. These are detailed records summarising the key information, progress, and actions taken in a specific case. They are a great reference for seeing how the Privacy Act has applied in various situations. The Privacy Act 2020 came into force on 1 December 2020, replacing the Privacy Act 1993.

Privacy Act 2020

New Zealand’s Privacy Act 2020 came into effect on 1 December, modernising the 1993 Act. It reflected changes in the wider economy and society to ensure the Act was fit for the technological world in which we live. Compare the two versions in a table form or read a series of information sheets about the changes that were made.