The Privacy Act 2020 and the 13 Information Privacy Principles
Applies to every Auckland business processing personal information
The Privacy Act 2020 sets out 13 Information Privacy Principles governing how businesses collect, store, use, and disclose personal information, with a new IPP 3A notification obligation in force from 1 May 2026. IPP 12 restricts sending personal information overseas unless the receiving party offers comparable protection, a rule that directly affects cloud and SaaS vendor choices. Penalties reach 10,000 dollars for individuals and 50,000 dollars for organizations, alongside Human Rights Review Tribunal claims. The Act also applies to overseas businesses that collect information from individuals in New Zealand. We map Privacy Act obligations into Auckland software from the discovery phase.