New Zealand Privacy Act – A Complete Guide to Compliance

Ever wondered how to comply with the New Zealand Privacy Act?

The New Zealand Privacy Act came into force in December 2020. It brought New Zealand law closer to the stringent EU General Data Protection Regulation (GDPR) rules.

New Zealand’s data protection law provides individuals with rights regarding the collection and use of their information. It compels covered entities to disclose the purposes of data collection, define how data is used, and detail whether it’s disclosed to other parties.

If you obtain personal data from users of your website in New Zealand, you could be subject to the New Zealand Privacy Act 2020.

Read on to learn about the New Zealand Privacy Act requirements, how it affects businesses and consumers, and the consequences of non-compliance.

So, let’s start and remember to read through to the end!

What is the New Zealand Privacy Act?

The New Zealand Privacy Act 2020 is a law in New Zealand that regulates the use, storage, and disclosure of information about individuals. It superseded the earlier Privacy Act 1993 and implemented several significant changes that enhanced privacy controls for individuals.

The 2020 Act brought many changes over the 1993 Act. Though the basic principles are the same, the 2020 Act enhances privacy management and individual protection and aligns regulations with global standards. 

The following are some of the significant changes:

• One of the major reforms of the Privacy Act is the requirement that organizations report data breaches that could significantly harm individuals. This measure enhances transparency and allows for faster action against such breaches.
• The Privacy Act applies worldwide. Any company that does business in New Zealand, no matter where it is located, must comply with the rules governing the management of personal information of New Zealand citizens.
• The Privacy Act strengthens people’s rights, such as the right to access and correct personal information and object to its use or disclosure in specific situations.
• A new principle (number 12) stresses the value of being proactive and taking steps to avoid privacy risks at an early stage. This prompts a more proactive attitude towards protecting data.
• The commissioner has more power to investigate complaints, direct, and enforce compliance with the Privacy Act.

Who Must Comply With the New Zealand Privacy Act? 

Any business whose services are present in New Zealand, or which gathers individuals’ personal information in the nation, has to adhere to the New Zealand Privacy Act 2020, as outlined in Subpart 1, Preliminary provisions.

The act applies to all businesses operating in New Zealand. Foreign companies can also be considered as conducting business in the country, even if there are no monetary transactions or commercial activities involved.

What are the Consumer Rights Under the New Zealand Privacy Law

​​The Privacy Act is actually all about providing individuals with the right to manage their information. As a business owner, one should be mindful of consumer rights.

• Right to Know: The visitor is entitled to know what you do with their personal information. To meet this requirement, you should have a simple ready-to-read privacy policy on your website that states the following:
  • What you collect: Such as names, email addresses, and browsing behaviors.
  • Why you collect it: Maybe for processing orders, sending newsletters, or creating a personalized user experience.
  • Who it may be shared with: For example, third-party providers with whom you subcontract some services.
  • How long do you retain it: State whether you hold the information until the user unsubscribes or for some business objective.
• Right to Access: They can request to view personal data pertaining to themselves so that they can verify whether it is indeed held by you unnecessarily.
• Right to Rectify: If visitors encounter any inaccuracy, they can reach out to edit or correct it. Such inaccuracies, for instance, could be correcting a typo in the spelling of their name or alterations to their address.
• Right to Object: Guests have a right to object to the processing of their data. This right can object to receiving marketing emails, specific advertising, or any other objectionable usage.
• Right to Erasure (Right to Be Forgotten): In some instances, guests can ask you to remove their personal data completely. This could be the case if they no longer visit your site, have revoked their consent, or if the data is no longer required.

How Businesses Can Comply With New Zealand Privacy Act Regulations

To prepare for complying with the New Zealand Privacy Act 2020, companies need to review their privacy policy to ensure that all requirements of notice and transparency are fulfilled.

Update your cookie policy so that New Zealand residents are well-informed and aware of how to exercise their right to opt in to any cookies implemented for personalized ads.

In addition, implement the correct security controls to safeguard the personal information you gather.

WP Legal Pages Compliance Platform is one such platform where you can comply with the New Zealand Privacy Act requirements.

WP Legal Pages Compliance Platform helps businesses comply with the New Zealand Privacy Act 2020 by providing accurate, policy-ready content through its privacy policy generator, ensuring transparency and meeting notification obligations.

WP Legal Pages plugin asks simple questions regarding your company and creates a special policy based on the answers you provide, which can be easily published on your website.

Let’s check how we can create a privacy policy for your website to help you comply with the New Zealand Privacy Act requirements.

Step 1: Install the WP Legal Pages Plugin  

From your WordPress Dashboard, click on Plugins > Add New.

Search for WPLegalPages in the search bar.

Click on the Install Now Button.

Activate the WP Legal Pages plugin by clicking the Activate button.

Step 2: Configuring WP Legal Pages Plugin

Once you have activated the plugin, you can access it directly from the Dashboard.

Next, Accept the terms of use of the WP Legal Pages plugin.

Step 3: Create an Account with WP Legal Pages Plugin 

To generate legal pages for your website, scroll down from the dashboard and click Create Page.

This will open the WP Legal Pages wizard. From the WP Legal Pages wizard, choose the Standard Privacy Policy template and click the Create button.

Once you click Create, a pop-up will appear, asking you to create a new account. Click on Continue with Free to create an account.

Once you sign up, your account will automatically connect to your site, and you can start creating legal pages for your website.

That’s it. You have created an account and can now start creating your website’s Legal Pages. Let’s see how we can create a privacy policy according to the New Zealand Privacy Act requirements.

Step 4: Making a Privacy Policy for a Website

You will now see Four Templates available in the free version. Click on the Standard Privacy Policy option to create a Privacy policy for your educational website.

Fill in the Basic Details and click Next.

Select the appropriate section for your legal policy, then click Next.

That’s it! Your Education privacy policy is ready.

Click the Create and Edit option to edit or add additional information to your privacy policy.

After you have made the necessary changes, click on Publish.

That’s all! Your Standard Privacy Policy is ready with just a few clicks. 

Like other data privacy laws worldwide, the New Zealand Privacy Act 2020 does not require consent from individuals to process lawfully obtained personal data.

However, consent is still a valid basis for processing, and is particularly required for direct marketing under the Unsolicited Electronic Messages Act 2007.

WP Legal Pages Compliance Platform also provides a consent management platform (CMP) that helps to meet the opt-in consent requirements for targeted advertising outlined by the law.

WP Cookie Consent plugin assists business owners in creating cookie notices for their website in a matter of minutes that comply with data privacy laws. It allows them to get consent from users for cookies before dropping them on visitors’ devices.

The plugin helps your business stay compliant with the law and provides insights and analytics on user behavior.

Additionally, the plugin, just like WP Legal Pages, provides a step-by-step wizard with numerous customization options for changing and formatting the appearance of the cookie notice.

New Zealand Privacy Act Penalties and Fines for Non-Compliance

Organizations or individuals breaching New Zealand’s Privacy Act 2020 would get compliance notices or access directions from the Privacy Commissioner.

Individuals and organizations liable for certain offenses under the act face fines up to $10,000 for individuals and $50,000 for organizations that commit specific violations.

Fines may be imposed if any of the following happens:

• Not complying with a compliance notice
• Not complying with an access order
• A cross-border transfer of personal information that is prohibited
• Not informing the OPC (Office of the Privacy Commissioner) properly of a notifiable privacy breach

In some situations, criminal charges can be filed. For instance, it is a criminal offense to dispose of personal information while aware that there has been a demand for the information.

FAQ

Conclusion 

If your company is subject to the New Zealand Privacy Act 2020, make sure to follow these procedures to ensure compliance:

Review your cookie and privacy policies to meet notification and transparency requirements, allowing users to opt in for targeted advertising. Implement security protocols to protect information from unauthorized access or breaches.

Employ a Data Protection Officer (DPO) to assist you in adhering to all Information Privacy Principles (IPPs) as defined in the law.

Make it easy for users to exercise their rights by having a Data Subject Access Request form on your website.

To help you comply with New Zealand privacy law, we recommend that you use our consent management platform and privacy policy generator from the WP Legal Pages Compliance Platform.

If you like this article, you might also like reading:

• Nebraska Data Privacy Act – How to Comply
• Delaware Personal Data Privacy Act – Easy Compliance Guide
• Montana Consumer Data Privacy Act (MCDPA): What Website Owners Need to Know

Streamline compliance with legislation, such as the New Zealand Privacy law and more, using the WP Legal Pages Compliance Platform.