The Privacy Act 2020 (Act) and its Information Privacy Principles (IPPs) govern how agencies collect, use, disclose, store, retain and give access to personal information. The Act gives the Privacy Commissioner the power to issue codes of practice that modify the operation of the Act in relation to specific industries, agencies, activities or types of personal information. The following codes are currently in place:

• Biometric Processing Privacy Code;
• Credit Reporting Privacy Code;
• Health Information Privacy Code;
• Justice Sector Unique Identifier Code;
• Superannuation Schemes Unique Identifier Code;
• Telecommunications Information Privacy Code; and
• Civil Defence National Emergencies (Information Sharing) Code.

The Biometrics Processing Privacy Code is the Privacy Commissioner's most recent code which came into force in November 2025. It sets out rules governing the purpose, sourcing, collection, storage, accessibility, retention, disclosure and limitations on the use of biometric information. Any biometric processing activities that commenced after 3 November 2025 must comply with the Code from the commencement of the biometric processing. Biometric processing that commenced on or before 3 November 2025 has a nine-month grace period to uplift the processing to comply with the Code. The grace period expires on 3 August 2026, so any historical biometric processing activities must be compliance with the Code from that date.

Enforcement is through the Privacy Commissioner who has the power to investigate any action which appears to interfere with the privacy of an individual and can do so either on a complaint made to the Privacy Commissioner or on the Privacy Commissioner’s own initiative. The Privacy Commissioner can also issue compliance notices requiring agencies to do or refrain from doing something in order to comply with the Act.

Under the Act, an "agency" can be any person or body of persons, whether corporate or unincorporated, and whether in the public sector or in the private sector.

The Act has an extraterritorial scope – it applies to any actions taken by an overseas agency in the course of carrying on business in New Zealand, regardless of where the information is or was collected or held and where the person to whom the information relates is located. An agency may still be treated as carrying on business in New Zealand regardless of whether or not it has a physical place of business in New Zealand, charges any monetary payment for goods or services within New Zealand, or makes a profit from its business in New Zealand. For agencies subject to the Act (whether New Zealand agencies or overseas agencies), it is irrelevant where the personal information was collected, where it is held, or where the individual is or was located (i.e. the Act can extend to personal information collected overseas about foreign data subjects).

In November 2025, the Statutes Amendment Act 2025 received royal assent implementing minor and technical amendments to the Act including clarifications around principal agency's liability, more discretion for the Privacy Commissioner to decide to investigate a complaint and the limited application of the Act to domestic affairs. 

In September 2025, the Privacy Amendment Act 2025 received royal assent amending the Act. The key amendment to the Act is the introduction of a new IPP 3A, requiring agencies that collect personal information 'indirectly' (i.e. not directly from the relevant individual) to provide the individual with information about the processing of their data. All agencies collecting personal information indirectly are expected to comply with IPP 3A from 1 May 2026.

Currently, under IPP 3, the Act requires agencies who collect personal information directly from the individual to ensure the individual is aware of certain details, such as the fact of collection, the purposes for which the information will be used, the intended recipients and the individual's right to request access to and correction of their personal information.IPP 3A requires agencies collecting personal information from a source other than from the individual concerned to take reasonable steps to ensure that the individual is aware of the same information.

There are certain exceptions to complying with IPP 3A including where the individual has previously been made aware of the agency's collection of their personal information, or compliance with IPP 3A is not reasonably practicable in the circumstances.

In September 2023, the Privacy Commissioner issued (non–binding) guidance on the application of the Act's IPPs to the use of AI tools in New Zealand (the Guidance). The Guidance is consistent with key themes from developing international regulations (e.g. the importance of transparency and explainability; accuracy; robustness and security; accountability; and human values and fairness). The Privacy Commissioner has recommended, among other things, that while not mandatory under the Act, it is generally best practice to undertake a Privacy Impact Assessment at the outset of an AI project. The Guidance also recognises an important element which is unique to New Zealand – the need to consider te ao Māori perspectives on privacy (broadly, te ao Māori is the Māori worldview including tikanga Māori - Māori customs and protocols). Specific concerns identified in the Guidance include:

• bias from systems developed overseas that do not work accurately for Māori;
• collection of Māori information without work to build relationships of trust, leading to inaccurate representation of Māori taonga that fail to uphold tapu and tikanga; and
• exclusion from processes and decisions of building and adopting AI tools that affect Māori whānau, hapū, and iwi, including use of these tools by the public sector.