General Business · Employer knowledge

Privacy & information

Collect and use only the personal information the business needs and is entitled to handle, protect it appropriately, respond to access and correction rights, and be ready to assess and manage privacy breaches.

Build privacy into ordinary business processes

The Privacy Act 2020 contains 13 information privacy principles governing how agencies collect, store, access, correct, use, disclose and retain personal information. Principle 5 requires reasonable security safeguards. Principle 9 says personal information must not be kept longer than required for a purpose for which it may lawfully be used.

From 1 May 2026, new Information Privacy Principle 3A also applies to certain indirect collections of personal information. Businesses should check whether they need to notify an individual when collecting that person's information from someone else.

Manager focus

Know what you holdMap employee, customer, supplier and other personal information, why it is collected, where it is stored and who can access it.

Collect lawfully & transparentlyCheck the collection is necessary for a lawful purpose and give the required privacy information, including where IPP 3A applies to indirect collection.

Secure & limit accessUse safeguards reasonable for the sensitivity, volume and consequences of misuse, including service-provider arrangements.

Retain deliberatelyApply legal retention requirements where they exist, then remove personal information when it is no longer required for a lawful purpose.

Manager check

Do we know what personal information we collect and why?
Are privacy statements and collection notices accurate for the way information is actually obtained?
Have we checked the new IPP 3A requirements for indirect collection from 1 May 2026?
Is access limited to people who need the information?
Can we respond appropriately to access and correction requests?
Do retention rules distinguish statutory records from information that no longer needs to be kept?
Do staff know how to recognise and escalate a privacy breach?

Privacy breaches

If a privacy breach has caused, or is likely to cause, serious harm, the business must notify the Privacy Commissioner and affected people as soon as practicable, unless an exception applies. The Privacy Commissioner says its expectation is notification within 72 hours of becoming aware of a notifiable breach; that 72-hour period is guidance, while the statutory requirement is as soon as practicable.

Privacy principles →Privacy breach guidance →Back to General Business Hub

NZQC provides practical educational information. It is not legal advice and does not certify that a provider is compliant. Check the official source and the requirements that apply to your service, contracts and scope.