New Zealand Privacy Act 2020 and AI

What it is

New Zealand regulates AI that uses personal information through its general privacy law, the Privacy Act 2020, rather than an AI-specific statute. The Office of the Privacy Commissioner (OPC) has set out how the Act applies in two pieces of guidance.

• Expectations for agencies using generative AI, issued on 15 June 2023.
• Artificial Intelligence and the Information Privacy Principles, published in September 2023 with a one-page summary. It covers generative AI and other systems that interpret data or automate tasks.

The OPC’s starting point is that the Privacy Act applies to everyone using AI tools in New Zealand. The Act is technology neutral and principles based, so the same rights and protections apply to AI as to any other handling of personal information. Responsibility for compliance lies with the agency, whether in the public, private or not-for-profit sector.

Who it applies to

Every “agency” under the Privacy Act, which covers government bodies, businesses and not-for-profits of any size that handle personal information. The guidance applies whenever an AI tool is used with personal information, from collecting training data and training a model to taking user input, receiving a response and acting on it.

What it expects

The Information Privacy Principles at each stage. The IPPs govern how personal information is collected (IPPs 1 to 4), used and protected (IPPs 5 to 10) and shared (IPPs 11 and 12), with rules on unique identifiers (IPP 13). The OPC’s key questions follow from them.

• Is the training data behind the tool relevant, reliable and ethical? Training data collected in breach of IPPs 1 to 4, or with bias that limits accuracy, is a problem under IPP 8.
• Does the use fit the purpose for which the information was collected? Reusing it for training may not (IPP 10).
• How are you testing that the tool is accurate and fair for your purpose, and are you talking to affected communities, including Māori?
• How are you tracking and managing new risks to information, including the security of prompts and training data (IPP 5)?

Expectations for generative AI. The OPC sets eight expectations for agencies considering a generative AI tool.

• Senior leadership considers the risks and explicitly approves its use.
• The agency reviews whether the tool is necessary and proportionate, or whether another approach would do.
• A privacy impact assessment, or an algorithmic impact assessment, comes first, including feedback from affected communities and due diligence on the provider.
• The agency is transparent, in plain language, about how, when and why the tool is used where it affects customers’ personal information, taking particular care with children.
• The agency engages with Māori about potential impacts on their communities and taonga.
• Procedures exist for accuracy and for access and correction requests.
• A human reviews outputs before the agency acts on them.
• Personal or confidential information is not entered unless the provider has confirmed it is not retained or disclosed.

The OPC strongly cautions against using sensitive or confidential data for training. Its overall advice is that if in doubt, do not use AI tools to handle personal information.

Recent changes to the law

Two changes since the AI guidance was written affect AI use.

• IPP3A. From 1 May 2026, an agency that collects personal information indirectly, from someone other than the individual, must notify the individual unless an exception applies. It applies to information collected from that date and matters for AI systems that draw on data from third parties.
• Biometric Processing Privacy Code 2025. The code applies to biometric processing, such as facial recognition, that started on or after 3 November 2025, and from 3 August 2026 to processing that was already under way. Amendment No 1 added a rule 3A, in force from 1 May 2026 for newer processing.

Key dates

The OPC published its generative AI expectations on 15 June 2023 and its AI and IPPs guidance in September 2023. It has said the generative AI material is subject to change as the technology evolves. The Biometrics Code took effect on 3 November 2025 and fully on 3 August 2026, and IPP3A on 1 May 2026.

How it relates to other frameworks

Public service agencies apply this guidance alongside the Public Service AI Framework and, if they have signed it, the Algorithm Charter. Businesses can use MBIE’s Responsible AI Guidance for Businesses, which lists the Privacy Act among the laws that apply. Organisations operating in Australia meet the OAIC’s AI guidance and, from 10 December 2026, the Privacy Act ADM transparency rules. New Zealand has no equivalent of those automated decision disclosure rules.