Cybersecurity Policy Report, New Zealand Privacy Amendments Approved, Await Royal Assent, (Sep 22, 2025)

By Tony Foley

New Zealand’s Privacy Amendment Bill, which amends the New Zealand Privacy Act 2020 in several respects, received its third reading in the New Zealand Parliament on Sept. 18 and is now awaiting royal assent before becoming law.

The bill, which was originally introduced in September 2023, was reported out of the House in late March. Principal among other amendments contained in the final version of the bill is the introduction of Information Privacy Principle (IPP) 3A, which governs required notifications for indirect collections of personal data (CPR, April 7).

In its final form, the bill specifies that certain provisions of the amendments, including new IPP 3A, do not apply until May 1, 2026. In addition, the bill modifies section 49 of the Privacy Act 2020 to specify that refusals to provide access to personal information may be permissible when contrary to the interests of a minor under age 16, as well as when disclosure would be likely to prejudice the safe custody or rehabilitation of an individual who has been convicted of an offense or detained in custody.

Finally, the bill provides that for purposes of providing advice to the responsible minister as provided under Privacy Act 2020, the New Zealand Office of the Privacy Commissioner may assess the laws of a particular country on an individual basis or on the basis of the country being a member of a bloc of countries, including a country being a member of the European Economic Area (EEA) and therefore subject to the European Union’s General Data Protection Regulation (GDPR).

More information on the bill is available on this status page.

News: InternationalLegislation DataPrivacy DataSecurity