NEW ZEALAND Law and Practice Contributed by: Shelley Slade-Gully, Tina Liu, Phil Taylor and Veronica Hartley, Tompkins Wake
How Does It Compare to the EU Data Act? The CPDA is materially different in scope and applica - tion to the EU Data Act. The CPDA focuses primar - ily on enabling customer access to, and portability of, data held by designated entities, with regulated accreditation of third-party recipients. In comparison, the EU Data Act goes further by creating mandatory business-to-business (B2B) and business-to-govern - ment (B2G) data-sharing rights in certain circumstanc - es. The EU regime also contains detailed provisions on switching between cloud and data processing services and on interoperability, which are not central features of the CPDA. At the date of publication of this guide (10 March 2026), there is no indication that the New Zealand government intends to enact a law similar to the EU Data Act. It is considered unlikely given the relative size of the New Zealand market compared to that of its major trading partners. 3.2 Interaction of Data Regulation and Data Protection CPDA and the Privacy Act The CPDA operates alongside the Privacy Act. Where customer data includes personal information, the data holder must continue to comply with the Privacy Act’s Information Privacy Principles (for example, in relation to purpose limitation, security and correction rights), while also meeting any additional data-sharing, port - ability and accreditation obligations imposed under the CPDA. The CPDA provides a specific statutory avenue for customers who wish to request access to their desig - nated customer data. However, if the data holder con - travenes its obligations to provide the customer with access to their data in accordance with the CPDA, the contravention will be treated as an interference with the privacy of the customer under the Privacy Act. Further, data holders risk breaching the storage and security of personal information requirements under the Privacy Act if they breach the data storage and security requirements under the CPDA.
CPDA and IP Protection The CPDA does not displace the operation of existing laws that protect intellectual property rights. During the legislative process, the banking industry empha - sised the need to avoid the disclosure of product data that contains commercially sensitive information or information that constitutes a bank’s intellectual property. The CPDA requires the Ministry of Business, Innova - tion and Employment (MBIE), the government agen - cy responsible for administering the CPDA, to have regard to any intellectual property rights that may exist in relation to customer or product data when designat - ing new classes of customer or product data under any new designated regulations. 3.3 Rights and Obligations Under Applicable Data Regulation The CPDA (as described in 3.1 Objectives and Scope of Data Regulation ) creates a statutory framework for access to and portability of customer data and prod - uct data. Under Sections 14 and 15, a customer may request that a data holder provide their designated customer data to them directly, or to an accredited requestor acting on the customer’s behalf with the customer’s authorisation. The customer may then use that data for their own benefit – for example, authoris - ing a third-party budgeting application to access their banking transaction history held by a participating bank. As noted in 3.1 Objectives and Scope of Data Regulation , the CPDA does not include the switching, interoperability or FRAND provisions found in compa - rable overseas frameworks such as the EU Data Act; those matters fall outside the current scope of New Zealand’s statutory data-sharing framework. Where a data holder’s designated customer data constitutes personal information, the CPDA operates alongside the Privacy Act. A data holder’s obligations under Sections 14 and 15 to provide data are separate from, but complementary to, an individual’s access rights under IPP 6 of the Privacy Act; requests under the CPDA are expressly not treated as requests under IPP 6 (Section 51 (2) of the CPDA). If a data holder contravenes its obligations to provide data under Sec - tion 14, 15 or 16 (2) of the CPDA, that contravention is deemed to be an interference with the privacy of
348 CHAMBERS.COM
Powered by FlippingBook