Last review date: 20 December 2024

☒  applies to organizations located in the jurisdiction

☒  applies to organizations located outside of the jurisdiction offering goods or services to data subjects in the jurisdiction

☒  other

The Privacy Act will apply to any action taken by a New Zealand agency (whether or not while that agency is or was present in New Zealand) in respect of personal information collected or held by the agency.

The Privacy Act will also apply to an overseas agency in relation to any action taken by the overseas agency in the course of carrying on business in New Zealand with respect to personal information collected or held by that agency. The Privacy Act does not define "carrying on business in New Zealand," but section 4(3) of the Privacy Act states that an agency may be treated as carrying on business in New Zealand without necessarily:

1. Being a commercial person
2. Having a place of business in New Zealand
3. Receiving any monetary payment for the supply of goods or services
4. Intending to make a profit from its business in New Zealand

The Privacy Commissioner has informally stated that the test for whether an agency will be carrying on business in New Zealand will be relatively low.