NEW ZEALAND Law and Practice Contributed by: Shelley Slade-Gully, Tina Liu, Phil Taylor and Veronica Hartley, Tompkins Wake
Non-Personal Data There is no general regulation applicable to the trans - fer or other disclosure of non-personal information outside New Zealand. 5.2 Government Notifications and Approvals New Zealand does not require organisations to reg - ister, file or obtain prior approval from any authority before making international transfers of personal infor - mation. The applicable framework under IPP 12 of the Privacy Act imposes substantive transfer-restriction obligations on the disclosing agency (see 5.1 Restric- tions on International Data Transfers ), but compli - ance with those obligations is self-assessed and does not involve any prior notification to or authorisation by the Privacy Commissioner or any other regulator. No binding scheme regulations or prescribed coun - try regulations have been made under Section 213 or 214 of the Privacy Act as at the date of publication of this guide. New Zealand has no export control regime applying to data transfers as such, and no equivalent of Article 32 of the EU Data Act. 5.3 Data Localisation Requirements Data Localisation Requirements New Zealand does not impose general statutory data localisation or residency requirements. There is no blanket prohibition on storing or processing personal information offshore. Cross-Border Transfer Framework IPP 12 governs disclosure of personal information out - side New Zealand. Before disclosing personal infor - mation to foreign persons or entities, agencies must meet specified safeguards, including the following: • individual authorisation with express notification that offshore protections may differ; • the recipient being subject to the Privacy Act (by carrying on business in New Zealand); • the recipient being subject to privacy laws provid - ing comparable safeguards; • the recipient being a participant in a prescribed binding scheme; or • the agency otherwise ensuring comparable protec - tions through contractual or other means.
Complementing this, Section 11 of the Customer and Product Data Act 2025 imposes requirements for the standardised handling of customer and product data, applying to New Zealand agencies wherever they operate and to overseas agencies conducting busi - ness in New Zealand, regardless of where the data is located. Remote Access The Privacy Act does not distinguish between trans - ferring information offshore and granting remote access to information held in New Zealand from an offshore location. Both are regulated under IPP 12. Sector-Specific Codes Section 32 of the Privacy Act enables the Privacy Commissioner to issue codes of practice that may modify the application of one or more IPPs. The Health Information Privacy Code 2020, Biometric Processing Privacy Code 2025, Telecommunications Information Privacy Code 2020, and Credit Reporting Privacy Code 2020 each apply IPP 12’s cross-bor - der safeguards to certain sector-specific disclosure grounds and require that offshore recipients provide protections comparable to those in the Privacy Act as modified by the relevant code. The Civil Defence National Emergencies (Information Sharing) Code 2020 makes IPP 12 compliance subject to reasonable practicability during national emergen - cies. None of the codes imposes data localisation or resi - While there is flexibility to use offshore infrastruc - ture and service providers, agencies must conduct transfer impact assessments, implement contractual protections with offshore processors, and maintain documentation demonstrating IPP 12 compliance. Sector-specific codes may require additional safe - guards depending on the type of information being transferred. dency requirements. Practical Implications
354 CHAMBERS.COM
Powered by FlippingBook