Technology, Data & Cyber in New Zealand

Essentials guide · Source-checked research55% of statements checked against a source19 checked against an official source13 checked against a secondary sourceChecked 2026-10-199 held back until checked against an official source8 topics include AI-written statements, not source-checkedNot yet professionally reviewed

• The Privacy Act 2020 and its Information Privacy Principles govern the collection, use, disclosure and security of personal information, overseen by the Office of the Privacy Commissioner.

  Applies to public and private sector agencies of any size, and to overseas organisations carrying on business in New Zealand.Office of the Privacy Commissioner · checked 2026-10-19

• Organisations must notify the Privacy Commissioner and affected individuals of a privacy breach that has caused or is likely to cause serious harm.

  Failing to notify the Privacy Commissioner is an offence. Notification should be made as soon as practicable after becoming aware of the breach.Office of the Privacy Commissioner · checked 2026-10-19

• Personal information may be disclosed to an overseas recipient only if the recipient is subject to comparable safeguards (through its own laws, a binding scheme, a prescribed country or contractual terms), or the individual authorises it after being told it may not be protected to the same standard.

  Privacy Act 2020; does not apply to using an overseas cloud provider that only stores or processes data for the New Zealand organisation.Office of the Privacy Commissioner · checked 2026-10-19

• The European Commission has recognised New Zealand as providing an adequate level of data protection, allowing personal data to flow from the EU without additional safeguards.

  European Commission · checked 2026-10-19

Read the full guide: Data protection and cyber