Construction & Trades · Employer knowledge

Privacy & worker information

Collect and share only the personal information your business needs, protect it appropriately, and make privacy responsibilities clear across office, site and contractor processes.

The Privacy Act 2020 applies to New Zealand agencies that collect and hold personal information. Its Information Privacy Principles cover matters including why information is collected, how it is collected, storage and security, access and correction, retention, use and disclosure. From 1 May 2026, IPP 3A also applies when personal information is collected indirectly, subject to the Act's exceptions.

Construction and trades businesses may hold employee, applicant, contractor and site-access information. Privacy obligations still apply when information moves between office systems, supervisors, clients, principal contractors or other parties.

What should a manager have in place?

Privacy controls should match the information the business actually handles. Do not collect or circulate personal information simply because it may be useful later.

Purpose & collectionKnow why personal information is being collected, whether it is necessary for that lawful purpose, and what information needs to be given to the person when collecting it.

Access & securityUse reasonable safeguards against loss, misuse and unauthorised access, use, modification or disclosure. Limit access to people who need the information for their work.

Sharing & site coordinationBefore sharing worker or contractor information with clients, principal contractors or other parties, check that the disclosure is permitted and only share what is appropriate for the purpose.

Privacy incidentsHave a pathway for suspected privacy breaches. The Privacy Act requires notification to the Privacy Commissioner and affected people when a privacy breach meets the statutory notifiable-breach threshold, subject to the Act's provisions.

Manager check

Can we explain why we collect each important category of employee or contractor personal information?
Are site, HR and contractor records accessible only to people who genuinely need them?
Before personal information is sent to another business or site contact, do we check the purpose and whether disclosure is permitted?
Can workers request access to or correction of their personal information through a known process?
Do managers know where to escalate a suspected privacy breach and who assesses whether notification is required?

Check current Privacy Commissioner guidance →Privacy Act 2020 →Back to Construction & Trades Hub

NZQC provides practical educational information. It is not legal advice and does not certify that a provider is compliant. Check the official source and the requirements that apply to your service, contracts and scope.