Your responsibilities

The Privacy Act 2020 introduces a new principle 12 with requirements for disclosing personal information to a foreign person or entity. Use the decision tree below to help you work out if principle 12 applies to the information you are disclosing and if so, if you comply with it.

Note that principle 12 does not apply to all circumstances in which, under principle 11(1), personal information may be disclosed. It applies to most of those circumstances but it does not apply where the agency disclosing the personal information is doing so on the basis that:

• the personal information is being disclosed to the person concerned (including the person’s authorised representative)
• the disclosure of personal information is necessary in order to enable an intelligence and security agency to perform its functions, or
• the personal information is publicly available, and, in the circumstances, it would not be unfair or unreasonable to disclose the publicly available information.

Principle 12 also does not apply:

• where the personal information is sent to an agent for storage or processing and the agent does not use or disclose the information for its own purposes (in this case there is no "disclosure" for the purposes of the Act), or
• if another statute expressly authorises or requires the disclosure of personal information to the foreign person or entity.

If principle 12 does apply, the best and most practical way to comply with it might be to have an agreement with your foreign person or entity that provides for comparable safeguards to New Zealand's Privacy Act. You can create such an agreement by using the model contract clauses agreement template we have developed for your ease of use. You can read more about our principle 12 guidance here.