NZ Privacy Commissioner Takes Targeted Regulatory Action Over Privacy Compliance Concerns

In a case published on 5 October 2026, the OPC identified concerns that the organisation's publicly available privacy policies were based on overseas legislation and failed to reference New Zealand's Privacy Act 2020. The policies also did not clearly identify the New Zealand entity collecting personal information, raising potential compliance issues under Information Privacy Principle (IPP) 3.

Following an initial privacy breach notification, the OPC attempted to work with the organisation to resolve these concerns. However, the organisation stopped responding, preventing the regulator from confirming whether appropriate improvements had been made.

Rather than issuing a public adverse comment, the Privacy Commissioner adopted a targeted regulatory approach, communicating concerns directly to the organisation's overseas parent company and an external accreditation body responsible for regulatory oversight.

For records and information management (R&IM) professionals, the case reinforces the importance of maintaining privacy policies that reflect local legislative requirements, clearly identifying how personal information is collected and used, and ensuring organisations actively engage with regulators. It also demonstrates how unresolved compliance concerns can lead to regulatory escalation.

Read more:

Office of the Privacy Commissioner NZ – Case PBN/3886 [2026] NZPrivCmr3, published 5 October 2026.

• Source: Office of the Privacy Commissioner, New Zealand, 5 October 2026.