The Privacy Act 2020 and the 13 Information Privacy Principles
Applies to every Wellington business processing personal information
The Privacy Act 2020 sets out 13 Information Privacy Principles governing how businesses collect, store, use, and disclose personal information, with a new IPP 3A notification obligation in force from 1 May 2026. IPP 12 restricts sending personal information overseas unless the receiving party offers comparable protection, a rule that directly affects cloud and SaaS vendor choices. Penalties reach 10,000 dollars for individuals and 50,000 dollars for organizations, alongside Human Rights Review Tribunal claims. We map Privacy Act obligations into Wellington software from the discovery phase.