Laws and data licensing
New Zealand: privacy laws and AI data licensing
Short answer
If your records include people in New Zealand, the main rules are: Privacy Act 2020.
In short
- Country
- New Zealand
- Main privacy laws
- Privacy Act 2020.
- Note
- Principles-based law with cross-border rules.
- Last reviewed
- 2026-10-09
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
What to know#
Principles-based law with cross-border rules.
For suppliers#
- SourceX works with businesses based in New Zealand when at least 90% of their records are in English
- Records tied to other countries are reviewed against their rules or excluded
- Personal details are removed before anything is shared
Can records collected for one purpose be reused for AI work under IPP 10?#
Only if the new use fits the purpose the information was collected for, or an exception in IPP 10 applies. The Privacy Commissioner's AI guidance says the information privacy principles apply at every stage of building and using AI, from collecting training data to training a model, and that reusing information collected for another purpose to train AI may go against IPP 10.
Two IPP 10 exceptions matter most for licensing. Information may be used in a form in which the individual concerned is not identified, or for statistical or research purposes where it will not be published in a form that could reasonably be expected to identify the individual. The agency must believe on reasonable grounds that the exception applies. The not-identified exception depends on the person actually not being identifiable, so removing a name alone may not be enough.
When can records be disclosed to another company under IPP 11 and IPP 12?#
IPP 11 allows disclosure to another company when it is one of the purposes of collection or an exception applies, including not-identified and statistical or research exceptions like those in IPP 10. Handing identifiable records to a licensee for its own use is a disclosure, so it needs one of these grounds.
IPP 12 adds a test when the recipient is a foreign person or entity. Grounds include the person's authorisation after being expressly told that the recipient may not be required to protect the information in a way comparable to the Act, and the agency reasonably believing the recipient will protect it with comparable safeguards. The principle lists other grounds too, so check the current text before relying on any one of them.
Two practical points follow. An overseas provider that only stores or processes information on the agency's behalf, such as a cloud service, is not a recipient under section 11, but once a provider uses the information for its own purposes, IPP 12 applies. And an overseas buyer can itself be subject to the Act if it carries on business in New Zealand, even without a physical presence there.
Which New Zealand checkpoints apply before records leave the business?#
The order below follows the principles a reviewer usually works through. Information that is genuinely not identifiable is not personal information, so the later checkpoints mainly bite on records that still identify people.
| Checkpoint | Principle | Question to answer | Typical evidence |
|---|---|---|---|
| New use | IPP 10 | Is the AI use directly related to the original purpose, or does an exception apply? | Collection notices and privacy statements in force at the time |
| Identifiability | IPP 10 and IPP 11 | Could anyone in the records still be identified by other means? | De-identification method and a re-identification risk review |
| Disclosure ground | IPP 11 | Which ground supports giving records to the recipient? | Authorisation records or the documented exception relied on |
| Overseas recipient | IPP 12 | Which IPP 12 ground applies to a foreign recipient? | Comparable-safeguards assessment or express authorisation |
| Provider role | Section 11 | Does any provider only store or process the data, or use it for itself? | Processing terms limiting use to the agency's purposes |
| Indirect collection | IPP 3A | Will the recipient need to notify people it collects about indirectly? | Recipient's notice plan or the exception it relies on |
What can the Privacy Commissioner do, and what changed in 2026?#
The Commissioner can issue compliance notices, and must be told about notifiable privacy breaches. A breach is notifiable when it has caused or is likely to cause serious harm, and the agency must notify the Commissioner and affected people as soon as practicable; 72 hours is given as a guide only. Failing to notify the Commissioner of a notifiable breach is an offence, with fines of up to NZ$10,000.
A new principle, IPP 3A, adds a notification obligation for personal information collected other than from the individual concerned, subject to exceptions. It applies only to information collected from 1 May 2026, which matters for any recipient of identifiable New Zealand records. Check the Commissioner's IPP 3A page for what the notice must contain.
SourceX can consider companies in New Zealand when the data they offer is at least 90% English, confirmed on the actual dataset; every dataset still goes through rights, privacy, quality and buyer-fit review.
Sources for this section
- The Privacy Commissioner says the information privacy principles apply at every stage of building and using AI, and that reusing information for training may conflict with IPP 10. Source
- IPP 10 permits use in a form that does not identify the individual, or for statistical or research purposes where results will not be published in an identifying form. Source
- IPP 11 sets the grounds for disclosing personal information, including the not-identified and statistical or research exceptions, based on a belief on reasonable grounds. Source
- IPP 12 limits disclosure to foreign persons or entities to listed grounds, including comparable safeguards and express, informed authorisation by the individual. Source
- A provider that stores or processes information solely on an agency's behalf is not treated as holding it under section 11; use for its own purposes brings the transfer under IPP 12. Source
- Overseas organisations can be carrying on business in New Zealand without a physical presence, and authorisation requires plain, express notice that comparable safeguards may not apply. Source
- IPP 3A is a new notification obligation for personal information collected other than from the individual, applying to information collected from 1 May 2026, subject to exceptions. Source
- Breaches that have caused or are likely to cause serious harm must be notified to the Commissioner and affected people as soon as practicable, with 72 hours as a guide. Source
- The Privacy Act 2020 introduced compliance notices and made failing to notify a notifiable breach an offence, with fines of up to $10,000. Source
Frequently asked questions
Which privacy laws apply to records about people in New Zealand?
Privacy Act 2020. Principles-based law with cross-border rules.
Can a company based in New Zealand license its data through SourceX?
Yes, when at least 90% of the company's records are in English. U.S. companies are SourceX's priority, records are reviewed against the rules that apply, and personal details are removed before anything is shared.
Can a U.S. business license records that include customers in New Zealand?
Records tied to New Zealand are reviewed against its rules or excluded from the license, and personal details are removed before anything is shared.
What happens to records that cannot be cleared?
Records that can't be cleared under the rules that apply are excluded, and the company approves every release before data moves.
General information, not legal advice. Laws change and their application depends on your facts. SourceX assesses which rules apply deal by deal with your counsel. Last reviewed 2026-10-09.