New Zealand · Privacy Act 2020 · Private sector

The Privacy Act 2020, run for businesses and not-for-profits

For New Zealand businesses, charities and other private-sector agencies — AccessPoint runs IPP 6 access and IPP 7 correction on the 20-working-day clock, reasonable charges, Privacy Commissioner complaints, notifiable privacy breaches, IPP 3A notices and privacy impact assessments.

Start Free Trial Request a Demo

New Zealand — Privacy Act (private sector) at a glance

Response deadline
As soon as reasonably practicable, and no later than 20 working days (ss.44, 63)
Working days
Exclude weekends, the listed public holidays including Matariki, and 25 December to 15 January
Extensions
A reasonable period, by notice within the 20 working days, for volume, consultations or complexity (s.48)
Charges
A private-sector agency may make a reasonable charge for making information available (s.66)
Breach notification
Notify the Commissioner and affected individuals as soon as practicable — ideally within 72 hours
Oversight
The Privacy Commissioner, and the Human Rights Review Tribunal

Built for New Zealand — Privacy Act (private sector)

One platform for the whole access-and-privacy mandate, pre-configured for this regime and running in your own Microsoft 365 tenant.

IPP 6 and IPP 7 on the working-day clock

Access and correction requests run on the 20-working-day limit over the Privacy Act's own definition of a working day — which skips the whole period from 25 December to 15 January — with extensions, transfers and the decision recorded on the case.

Refusal grounds, applied and cited

Withhold only on a ground in ss.49–53, release the rest with deletions, and give the reason and the right to complain to the Privacy Commissioner. The grounds are colour-coded for redaction, so every deletion carries its citation.

Charges, kept reasonable

A public-sector agency may charge only where s.67 authorises it; a business may make a reasonable charge for making information available, and may require it in advance. The charge, the advance-payment pause and the right to complain about it are part of the decision record.

Notifiable privacy breaches

Assess a breach against the serious-harm test, notify the Commissioner and affected individuals as soon as practicable, and keep the assessment either way. Failing to notify the Commissioner without reasonable excuse is an offence with a fine of up to $10,000.

IPP 3A notices

Since 1 May 2026, an agency that collects personal information from someone other than the individual must take reasonable steps to tell them. The pack ships an IPP 3A notice template and a readiness obligation to track it.

In your own tenant

Requests, breach assessments, PIAs and audit history stay inside your own Microsoft 365 and Azure tenant — no third-party cloud and no vendor access.

Same Act, no OIA

A New Zealand business answers to the same Privacy Act as a ministry — without the OIA beside it.

The Official Information Act does not reach the private sector, so for a business, a charity or an incorporated society, a request from someone for their own information is an IPP 6 request under Part 4 of the Privacy Act — nothing more and nothing less. The clock is the same 20 working days a ministry works to, the breach duty is the same, and the Privacy Commissioner can direct a business to give access just as it can direct a department. What trips private-sector teams is the detail: a reasonable charge is allowed, a privacy officer must be appointed (s.201), and since 1 May 2026 IPP 3A reaches the referrals, purchased lists and background checks that bring in personal information from someone else. AccessPoint runs all of it in one place, and because this pack shares its Privacy Act authority with the public-sector pack, a group with entities on both sides can install both.

20 working days IPP 6 and IPP 7, computed and tracked.
Charges allowed Reasonable, stated, and complainable.
One shared statute Installs beside the public-sector pack without duplication.

Configured out of the box

Installing the nz-privacy jurisdiction pack seeds your tenant with everything this regime needs. It is a starting point built from public information about the legislation, not legal advice — your legal counsel validates and adjusts it for your tenant.

Pack content last reviewed: 2026-10-20

Related guide: PIA Program Readiness Check
  • The Privacy Act 2020 as the legal-authority spine, shared with the public-sector New Zealand pack
  • IPP 6 access and IPP 7 correction request types on the 20-working-day clock
  • A Privacy Act working-day calendar that excludes 25 December to 15 January, with Matariki dated to 2052
  • Section 48 and 65 extension reasons, an advance-charge pause, and transfer letters
  • The ss.49–53 refusal grounds, colour-coded for redaction
  • Charge categories for making information available, aligned to the Commissioner's approach
  • Privacy Commissioner complaint tracking, with access-direction outcomes
  • Part 6 notifiable privacy breach rules, with notices to the Commissioner and affected individuals
  • An IPP 3A indirect-collection notice and a PIA template following the Commissioner's toolkit
  • Readiness obligations for the privacy officer, collection notices, security safeguards and breach notification
A jurisdiction pack's detail panel in AccessPoint settings, showing the pack description, version, what's new, and the checklist of items it imports: legal authorities, calendars, request statuses, request types, extension reasons, requestor categories and consultation types Click to enlarge
What a pack looks like in Settings (the Ontario municipal pack shown): the description, the version and what changed in it, and every item it imports with its statutory basis. Anything you have customized is never overwritten on update.

New Zealand — Privacy Act (private sector) Questions

Who is this pack for?
Private-sector agencies — under the Privacy Act 2020, any agency that is not a public-sector agency, such as businesses, charities, incorporated societies and clubs. Public-sector agencies use the OIA and Privacy Act pack. Health agencies add the Health Information Privacy Code pack (/solutions/new-zealand-hipc) for health information, and agencies using biometric processing add the Biometric Processing Privacy Code pack.

Can a private-sector agency charge for an access request?
Yes, within limits. A private-sector agency may impose a charge for making information available in response to an IPP 6 request, and for assistance where it releases information (s.66). Any charge must be reasonable, and all or part may be required in advance. For a correction request, a charge is allowed only for assistance and for attaching a statement of correction — not for the correction itself.

When must we notify a privacy breach?
When it is reasonable to believe the breach has caused, or is likely to cause, serious harm. Notify the Privacy Commissioner as soon as practicable after becoming aware of it (s.114) — the Commissioner suggests within 72 hours — and notify affected individuals, or give public notice, as soon as practicable (s.115). Failing to notify the Commissioner without reasonable excuse is an offence with a fine of up to $10,000 (s.118).

What does IPP 3A change?
From 1 May 2026, an agency that collects personal information about someone from another source must take reasonable steps to make them aware of the collection, its purpose, the intended recipients and their rights of access and correction, unless an exception applies. It does not apply to information collected before 1 May 2026. The pack includes an IPP 3A notice template.

Can we install it alongside the public-sector New Zealand pack?
Yes. Both packs carry the Privacy Act 2020, so the second one installed links to the authority and breach rules the first imported instead of duplicating them, and the tenant sees each Privacy Act duty once. That suits a group with public and private entities, or a shared service that handles both.

Where does personal information reside?
Entirely within your own Microsoft 365 and Azure tenant, in the region you choose. Requests, records, assessments and audit history never leave your control — no third-party cloud and no vendor access.

Go deeper

AccessPoint for Australia — ACT A push model with no fees at all AccessPoint for Australia — ACT Health Records Act A written answer in 2 weeks, access in 30 days, and determined fees AccessPoint for Australia — Federal FOI Act 1982 + Privacy Act 1988, OAIC FOI request management software The full request lifecycle — computed deadlines, records collection, redaction, audit. Compare the alternatives AccessPoint vs. legacy FOI tools, privacy suites, and manual tracking.

Flat annual pricing, published in full. Every feature in every size — access requests, privacy impact assessments, breach response, complaints, video & audio redaction, the public portal, repository connectors, and AI Assist. No per-user or per-module fees.

  • Under 500 employees$2,990/yr
  • 500–1,999 employees$7,990/yr
  • 2,000–9,999 employees$14,990/yr
  • 10,000+ employees$29,990/yr

See full pricing Build the business case

Run the Privacy Act 2020 in Your Own Tenant

Try AccessPoint free for 30 days, configured for New Zealand private-sector agencies. No credit card required.

Start Free Trial Request a Demo