New Zealand Privacy Act 2020 Cheat Sheet

The Privacy Act 2020 is New Zealand's primary law safeguarding personal information, ensuring organizations handle data responsibly while upholding individual privacy rights through clear principles and individual access rights.

Core Principles

Collect only necessary personal information for specific, lawful purposes.
Collect information fairly and non-intrusively.
Inform individuals about data collection purposes and usage.
Store personal information securely to prevent breaches.
Dispose of information securely when no longer needed.
Ensure data is accurate, up-to-date, and complete before use.
Use and disclose information only for the purpose it was collected.
Maintain privacy protections when transferring data, especially overseas.

Action Steps

Understand the Act's applicability to your organization.
Review and update data collection policies and practices.
Implement secure data storage and disposal procedures.
Train staff on privacy obligations and best practices.
Establish clear processes for handling access and correction requests.
Develop a robust complaint resolution mechanism.
Ensure transparency in data usage and disclosure.
Verify privacy safeguards for international data transfers.

Key Terms

Personal Information: Information about an identifiable individual.
Organisation: Includes government agencies, businesses, employers, schools, and healthcare providers.
Privacy Breach: An unauthorised access, use, disclosure, modification, or loss of personal information.
Purpose of Collection: The specific, lawful reason for gathering personal information.

Real World Examples

A retail store collects customer email addresses for marketing.: Must inform customers why emails are collected and how they'll be used; must secure the list and allow opt-outs.
A hospital stores patient health records.: Must ensure records are highly secure, only accessed by authorized personnel, and retained/disposed of according to regulations.
An employer reviews employee performance data.: Data should be accurate, used only for performance assessment, and kept confidential.

People

Office of the Privacy Commissioner: Oversees and enforces the Privacy Act 2020 in New Zealand.