The framework
The operative statute in New Zealand is the Privacy Act 2020, enforced by the Office of the Privacy Commissioner.
The posture is hybrid. Notice and purpose limitation govern collection and consent is reserved for sensitive cases, which makes first-party marketing more workable here than in strict opt-in markets.
Key instruments
Privacy Act 2020
New Zealand modernized in 2020 with mandatory breach notification and extraterritorial reach while keeping a principles-based, consent-light design, and EU adequacy makes it a comfortable node in global data architecture. 2026 brought IPP3A's notice duty for indirectly collected data on 1 May and, on 3 August, the end of the grace period for existing biometric processing under the Biometric Processing Privacy Code. Marketing email and SMS remain opt-in under the 2007 anti-spam law.
Marketing and advertising
Purpose-and-notice model built on thirteen Information Privacy Principles; IPP3A, in force since 1 May 2026, requires notice when personal information is collected indirectly. The Unsolicited Electronic Messages Act makes email and SMS opt-in. Treat the consent note above as the planning rule; the penalty line below is what mispricing it costs.
Cross-border transfers
IPP12: disclosure abroad requires comparable safeguards, consent or a prescribed country. New Zealand holds EU adequacy.
Enforcement and penalties
Compliance notices and modest fines (to NZD 10,000), plus Human Rights Review Tribunal damages; light by global standards.