New Zealand
Tier 3 Comprehensive law Asia-PacificPrincipal framework: Privacy Act 2020 (2020). Regulator: OPC. The Privacy Act 2020 carries 13 IPPs; a new duty to notify individuals on indirect collection (IPP3A) takes effect in 2026. EU adequacy since 2012.
At a glance
- Principal law
- Privacy Act 2020
- Regulator
- OPC
- Breach notification
- Notify the OPC and affected individuals as soon as practicable for serious-harm breaches
- Maximum penalty
- Modest offence fines; compensation runs through the Human Rights Review Tribunal
- DPO required
- Every agency must have a privacy officer
- Digital consent age
- No statutory age
- Extraterritorial reach
- Yes — carrying on business in New Zealand
Structure
- Structural pattern
- Not assessed
- Sub-jurisdictions
- None — no sub-national axis
- ISO code
- NZ
A Pattern 4 jurisdiction has no sub-national layer to model. Devolution elsewhere in the legal system does not imply it here — check each Act rather than reasoning from the country.
Transfers and adequacy
- EU member
- No
- EEA member
- No
- Holds EU adequacy
- Yes
- Review
- Confirmed Jan 2024 review
New Zealand; 1995 Directive (Dec. 2013/65/EU, done 19 Dec 2012).
Instruments
No instrument profiled yet.
Sources
- Primary Adequacy decision
Never independently verified — seeded from the prototype.