CevroNew Zealand: Privacy Act 2020 and what it requires
Privacy Act 2020: an established law with an active enforcement record. Overseen by Office of the Privacy Commissioner.
Key requirements at a glance
| Registration with the regulator | Not required |
|---|---|
| Data protection officer | Not required |
| Breach notification | No fixed hourly deadline in our reference |
| Cross-border transfer restrictions | Required |
| Data localization | Not required |
Penalties and enforcement
Fines and enforcement notices under the Act.
What to know in practice
A mature, clear regime built on privacy principles and mandatory breach notification.
How Cevro helps
- Maps Privacy Act 2020 to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in New Zealand?
Office of the Privacy Commissioner oversees Privacy Act 2020.
Is breach notification mandatory under Privacy Act 2020?
Our reference does not record a fixed hourly deadline for Privacy Act 2020. Check the statute and Office of the Privacy Commissioner guidance for the notification timing that applies to you.
Does New Zealand restrict cross-border data transfers?
Yes. Moving personal data out of New Zealand is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under Privacy Act 2020?
It is not a general requirement in our reference, though naming an accountable person is still good practice.
What are the penalties for non-compliance in New Zealand?
Fines and enforcement notices under the Act.