Privacy Act 2020

Section 4 is unusually direct about extraterritoriality: the Act applies to an overseas agency 'carrying on business in New Zealand' whether or not it has a place of business there, whether or not it makes a monetary profit, and regardless of where the personal information is held — an accessible website plus real commercial engagement with New Zealanders is the practical threshold, so the offering-goods limb is modeled as a trigger here. New Zealand holds a European Commission adequacy decision. Notifiable privacy breaches must be reported to the Office of the Privacy Commissioner and affected individuals where serious harm is likely. The Privacy Amendment Act 2025 added information privacy principle 3A, requiring agencies that collect personal information indirectly (from a source other than the individual) to notify the individual — the significant new duty for data brokers, enrichment vendors, and anyone building profiles from third-party sources; confirm its commencement date against the OPC before assuming it is or is not yet operative.