Securiti leads GigaOm's DSPM Vendor Evaluation with top ratings across technical capabilities & business value.

View

Compliance Checklist for New Zealand’s new Privacy Act

Published December 3, 2020 / Updated September 5, 2024
Author

Muhammad Faisal Sattar

Data Privacy Legal Manager at Securiti

FIP, CIPT, CIPM, CIPP/Asia

Listen to the content

On 1 December 2020, New Zealand’s new Privacy Act 2020 came into effect. Our experts at Securiti have compiled the following list of compliance actions to remind organizations of their obligations under New Zealand’s new Privacy Act.

Notify privacy breaches within 72 hours

Organizations must notify privacy breach that has caused serious harm to the affected individual or is likely to do so, to the Privacy Commissioner and the affected individuals as soon as practicable or within 72 hours after becoming aware of the breach. Where it is not reasonably practicable to notify the affected individual or each member of a group of affected individuals, organizations must notify the public in a manner that no individual is identified. Companies that fail to notify privacy breaches without any reasonable excuse would be liable on conviction to a fine not exceeding $10,000.

Notify privacy breaches caused by any outsourced third-party

Where an organization outsources data storage or data processing activities to a third-party, the third-party will be considered an agent to the organization. The principal data collecting organization will be responsible to fulfill the breach notification obligations, despite the fact that the breach is caused by any third-party acting as its agent. Anything relating to a notifiable privacy breach that is known by any employee or member of the third-party will be considered to be known by the principal data collecting organization.

Respond to data access requests not later than 20 working days after the day on which the request is received

Organizations must respond to a data subject’s access request as soon as is reasonably practicable, and in any case not later than 20 working days after the day on which the request is received. Where an organization refuses to respond to an access request, the individual has the right to complain before the privacy commissioner who may issue a binding access determination requiring the company to disclose personal information to the individual.

Respond to data correction requests not later than 20 working days after receiving the request

Organizations must decide whether or not to grant a data subject’s correction request as soon as is reasonably practicable after receiving a request and in any case not later than 20 days after receiving the request and notify its decision to the requester. Where an organization has to transfer the request to another organization, it must do so promptly, and in any case not later than 10 working days after receiving the request and notify the requester accordingly.

Ensure that data subjects are aware of the purpose of their data collected

Organizations must inform data subjects about the facts that their information is collected, the purpose for which the data is collected, the intended recipients of the information, the consequences of not providing the information, and the data subjects’ rights to access to and correction of their data. An organization must not use any personal information that was obtained in connection with one purpose for another purpose except with the authorization of the data subject.

Ensure comparable privacy safeguards to those that apply under New Zealand’s Privacy Act before transferring personal information outside New Zealand

Organizations can transfer personal information outside New Zealand only if the destination country provides comparable safeguards to those in New Zealand’s Privacy Act, the destination country is part of a prescribed binding scheme issued by the government of New Zealand, or if the data subject expressly authorizes the disclosure of personal information after having been informed of the inadequate data protection standards of the foreign country.

New Zealand’s Privacy Act 2020 applies to New Zealand entities as well as to overseas entities in the course of carrying on business in  New Zealand, irrespective of their size, geographical location, and whether or not they are registered in New Zealand.

Ask for a DEMO today to understand how Securiti can help you comply with New Zealand’s Privacy Act 2020, GDPR, and a whole host of other global privacy laws and regulations, such as the CPRA, with ease.


Frequently Asked Questions (FAQs)

The New Zealand Privacy Act sets out several obligations for organizations, including informing individuals about the collection and use of their personal information, obtaining consent for data processing, protecting data from unauthorized access, and allowing individuals to access and correct their personal data.

The New Zealand Privacy Act 2020 is the current privacy legislation. It applies to entities of all sizes and structures, including  individuals.

The New Zealand Privacy Act's main privacy requirements include collecting personal information for lawful purposes, obtaining consent for data processing, protecting data from unauthorized access, allowing individuals to access their data, and notifying individuals and authorities in the event of data breaches.

Principle 10 of New Zealand’s Privacy Act 2020 says personal information can only be used for the reason it was collected, unless the person agrees, it’s allowed by law, or it’s needed to prevent harm.

Your Data+AI Command Center

Enable Safe Use of Data and AI

Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox


Share

More Stories that May Interest You
Videos
View More
Mitigating OWASP Top 10 for LLM Applications 2025
Generative AI (GenAI) has transformed how enterprises operate, scale, and grow. There’s an AI application for every purpose, from increasing employee productivity to streamlining...
View More
Top 6 DSPM Use Cases
With the advent of Generative AI (GenAI), data has become more dynamic. New data is generated faster than ever, transmitted to various systems, applications,...
View More
Colorado Privacy Act (CPA)
What is the Colorado Privacy Act? The CPA is a comprehensive privacy law signed on July 7, 2021. It established new standards for personal...
View More
Securiti for Copilot in SaaS
Accelerate Copilot Adoption Securely & Confidently Organizations are eager to adopt Microsoft 365 Copilot for increased productivity and efficiency. However, security concerns like data...
View More
Top 10 Considerations for Safely Using Unstructured Data with GenAI
A staggering 90% of an organization's data is unstructured. This data is rapidly being used to fuel GenAI applications like chatbots and AI search....
View More
Gencore AI: Building Safe, Enterprise-grade AI Systems in Minutes
As enterprises adopt generative AI, data and AI teams face numerous hurdles: securely connecting unstructured and structured data sources, maintaining proper controls and governance,...
View More
Navigating CPRA: Key Insights for Businesses
What is CPRA? The California Privacy Rights Act (CPRA) is California's state legislation aimed at protecting residents' digital privacy. It became effective on January...
View More
Navigating the Shift: Transitioning to PCI DSS v4.0
What is PCI DSS? PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards to ensure safe processing, storage, and...
View More
Securing Data+AI : Playbook for Trust, Risk, and Security Management (TRiSM)
AI's growing security risks have 48% of global CISOs alarmed. Join this keynote to learn about a practical playbook for enabling AI Trust, Risk,...
AWS Startup Showcase Cybersecurity Governance With Generative AI View More
AWS Startup Showcase Cybersecurity Governance With Generative AI
Balancing Innovation and Governance with Generative AI Generative AI has the potential to disrupt all aspects of business, with powerful new capabilities. However, with...

Spotlight Talks

Spotlight 11:29
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Watch Now View
Spotlight 11:18
Rewiring Real Estate Finance — How Walker & Dunlop Is Giving Its $135B Portfolio a Data-First Refresh
Watch Now View
Spotlight 13:38
Accelerating Miracles — How Sanofi is Embedding AI to Significantly Reduce Drug Development Timelines
Sanofi Thumbnail
Watch Now View
Spotlight 10:35
There’s Been a Material Shift in the Data Center of Gravity
Watch Now View
Spotlight 14:21
AI Governance Is Much More than Technology Risk Mitigation
AI Governance Is Much More than Technology Risk Mitigation
Watch Now View
Spotlight 12:!3
You Can’t Build Pipelines, Warehouses, or AI Platforms Without Business Knowledge
Watch Now View
Spotlight 47:42
Cybersecurity – Where Leaders are Buying, Building, and Partnering
Rehan Jalil
Watch Now View
Spotlight 27:29
Building Safe AI with Databricks and Gencore
Rehan Jalil
Watch Now View
Spotlight 46:02
Building Safe Enterprise AI: A Practical Roadmap
Watch Now View
Spotlight 13:32
Ensuring Solid Governance Is Like Squeezing Jello
Watch Now View
Latest
View More
Databricks AI Summit (DAIS) 2025 Wrap Up
5 New Developments in Databricks and How Securiti Customers Benefit Concerns over the risk of leaking sensitive data are currently the number one blocker...
Inside Echoleak View More
Inside Echoleak
How Indirect Prompt Injections Exploit the AI Layer and How to Secure Your Data What is Echoleak? Echoleak (CVE-2025-32711) is a vulnerability discovered in...
What Is Data Risk Assessment and How to Perform it? View More
What Is Data Risk Assessment and How to Perform it?
Get insights into what is a data risk assessment, its importance and how organizations can conduct data risk assessments.
What is AI Security Posture Management (AI-SPM)? View More
What is AI Security Posture Management (AI-SPM)?
AI SPM stands for AI Security Posture Management. It represents a comprehensive approach to ensure the security and integrity of AI systems throughout the...
Beyond DLP: Guide to Modern Data Protection with DSPM View More
Beyond DLP: Guide to Modern Data Protection with DSPM
Learn why traditional data security tools fall short in the cloud and AI era. Learn how DSPM helps secure sensitive data and ensure compliance.
Mastering Cookie Consent: Global Compliance & Customer Trust View More
Mastering Cookie Consent: Global Compliance & Customer Trust
Discover how to master cookie consent with strategies for global compliance and building customer trust while aligning with key data privacy regulations.
View More
Key Amendments to Saudi Arabia PDPL Implementing Regulations
Download the infographic to gain insights into the key amendments to the Saudi Arabia PDPL Implementing Regulations. Learn about proposed changes and key takeaways...
Understanding Data Regulations in Australia’s Telecom Sector View More
Understanding Data Regulations in Australia’s Telecom Sector
Gain insights into the key data regulations in Australia’s telecommunication sector. Learn how Securiti helps ensure swift compliance.
Gencore AI and Amazon Bedrock View More
Building Enterprise-Grade AI with Gencore AI and Amazon Bedrock
Learn how to build secure enterprise AI copilots with Amazon Bedrock models, protect AI interactions with LLM Firewalls, and apply OWASP Top 10 LLM...
DSPM Vendor Due Diligence View More
DSPM Vendor Due Diligence
DSPM’s Buyer Guide ebook is designed to help CISOs and their teams ask the right questions and consider the right capabilities when looking for...
What's
New