| Privacy Act 2020Regulator: Office of the Privacy Commissioner (OPC) | In forceThe baseline privacy law. OPC received almost 600 serious privacy breach notifications in 2024/25, up 43%7. | Information privacy principles (IPPs) cover collection, security, access, use and disclosure. Serious breaches are notified to OPC. The Commissioner can issue compliance notices, as planned after the ManageMyHealth breach for failing to keep "reasonable security safeguards"22. Rules on overseas disclosure and the offence fine level were not re-verified for this edition. | Implication: security failures by a supplier become the customer's Privacy Act problem.
Response: privacy operations mapped to the IPPs, DLP, and a breach runbook with OPC notification steps. |
| Privacy Amendment Act 2025 · IPP3ANew principle on indirect collection | In forceRoyal Assent 23 Sep 202510. IPP3A applies from 1 May 2026911. | When an agency collects personal information from someone other than the individual, it must take reasonable steps to tell the individual: that it was collected, why, who may receive it, who holds it, any legal basis, and their access and correction rights. A partner can give the notice by contract, but the agency stays responsible. Exceptions apply, for example publicly available information910. | Implication: referral, credit, recruitment and data-broker flows need new notices.
Response: data-flow mapping and notice templates in an IPP3A readiness assessment. |
| Biometric Processing Privacy Code 2025Code of practice under the Privacy Act | In forceIssued 6 Aug 2025. New processing from 3 Nov 2025. Existing processing had to comply by 3 Aug 202612. | Covers automated processing that identifies, verifies or categorises people. A proportionality test with evidence of effectiveness, extra notice (retention, alternatives, trials, complaints) and limits on categorising people by health, emotion or protected traits12. | Implication: facial recognition, attendance and proctoring systems need assessments.
Response: privacy impact assessments, PKI-backed verification and identity governance. |
| Privacy reform proposalsPenalties and stronger Commissioner powers | ProposalThe Commissioner called for modernisation in Nov 20257. The Mar 2026 Cyber Security Strategy lists a civil pecuniary penalty regime as an option14. | Options include civil pecuniary penalties under the Privacy Act, a possible offence for handling illegally obtained personal information14, and more power for people to have agencies delete their data7. No bill had been reported in our sources. | Implication: privacy risk may soon carry fines large enough for boards to act.
Response: position managed privacy and security as insurance against the reform. |
| Customer and Product Data Act 2025Consumer data right · open banking first | In force · phasedMost regulations from 1 Dec 2025, with ANZ, ASB, BNZ and Westpac designated. Kiwibank for payments from 1 Jun 2026, and for customer data from 1 Dec 202613. | Banks share designated data and make payments for accredited requestors. Customers manage consent. Accredited requestors need adequate security safeguards and liability cover, and pay annual levies13. | Implication: fintechs need security evidence to be accredited; banks need hardened APIs.
Response: API protection, ISO 27001 evidence and Cloud HSM for keys. |
| RBNZ cyber resilience reportingReserve Bank of New Zealand · banks, NBDTs, insurers | In forceMaterial cyber incident notice from 8 Apr 2024. First capability survey due 1 Oct 2024. Periodic incident reports from 30 Apr 2025 for large entities17. | Report a material cyber incident within 72 hours of establishing materiality, weekends included. Entities with over NZ$2B of assets complete the capability survey annually, others every two years17. RBNZ's Guidance on Cyber Resilience sits alongside. Outsourcing policy (BS11) was not re-verified. | Implication: regulated entities expect providers to support 72-hour reporting.
Response: managed SOC with RBNZ notice templates and the BFSI Cloud evidence pack. |
| Cyber Security Strategy 2026–2030Plus the Cyber Security Action Plan 2026–2027 | PolicyPublished in early Mar 202614. | Four objectives: understand, prevent and prepare, respond, and partner. Actions include a cyber security reporting service for NCSC, a stronger mandate for the Government Chief Digital Officer, quantum readiness and a review of agency powers to disrupt threats14. | Implication: the government is moving from guidance towards obligations.
Response: PQC readiness, audits and incident-reporting runbooks. |
| Proposed critical infrastructure cyber regimeDepartment of the Prime Minister and Cabinet consultation | ProposalConsultation closed 19 Apr 2026. No legislation date set15. | Seven sectors: communications and data, defence, energy, finance, health, transport, and drinking water and wastewater. A cyber risk programme aligned to NIST CSF or ISO/IEC 27001:2022, with director attestations. Significant incidents: initial report within 24 hours, full report within 72 hours15. Directors could face up to NZ$100,000, or NZ$500,000 for a critical breach16. | Implication: data-centre and cloud providers to these sectors may inherit duties by contract.
Response: GRC, supplier assurance and OT assessments. |
| NZISM v3.9 + Protective Security RequirementsNew Zealand Information Security Manual · NCSC, part of the GCSB | CurrentVersion 3.9 released 9 May 202518. We did not check for a later version. | The security baseline for government systems. v3.9 aligns password controls with NIST, adds passwordless and phishing-resistant MFA, extends logging to event monitoring, and clarifies incident reporting for GCISO-mandated agencies18. | Implication: suppliers to agencies are assessed against NZISM controls.
Response: phishing-resistant MFA, PAM and a NZISM gap assessment. |
| New Zealand's Strategy for AI: Investing with confidencePlus Responsible AI Guidance for Businesses and the Public Service AI Framework | PolicyStrategy released 8 Jul 2025. Public Service AI Framework from Feb 20258. | No AI-specific law is planned. A "light-touch, proportionate and risk-based" approach relies on existing law, such as the Privacy Act and the Fair Trading Act, and adopts the OECD AI Principles. MBIE's guidance for businesses is voluntary8. | Implication: AI demand is adoption-led, with a skills gap: 43% of non-users cite a lack of expertise8.
Response: vCAIO advisory, ISO/IEC 42001 and AI literacy cohorts. |
| Cloud First policy (refreshed)Cabinet policy · Government Chief Digital Officer | Policy in forceRefresh endorsed by Cabinet in Apr 202319. | Agencies favour public cloud for new procurement. Only data classified RESTRICTED or below goes in public cloud, and RESTRICTED data should be hosted in New Zealand where a suitable onshore service exists. No new on-premise ICT without meeting criteria or GCDO approval. Māori data considerations apply19. | Implication: government buyers want onshore hosting and evidence for jurisdictional risk.
Response: sell to agencies only through established local suppliers, with Auckland-hosted Government Cloud services. |
| Digital Identity Services Trust Framework Act 2023Accreditation for digital identity providers | CheckEnacted 202331. Commencement and current accreditations were not re-verified for this edition. | A voluntary accreditation regime for providers of digital identity services, with rules set under the Act31. | Implication: a route for trusted identity and credential services.
Response: offer Managed PKI and HSM to accredited providers rather than seek accreditation in phase 1. |
| India–New Zealand Free Trade AgreementServices, mobility and investment | In forceSigned 27 Apr 202620. In force from 20 Oct 202621. | Market access for Indian services in about 118 sectors, including IT and professional services. 5,000 temporary employment entry visas for skilled workers and 1,000 working holiday visas a year21. A commitment to facilitate up to US$20B of investment into India20. | Implication: cross-border delivery from India and short assignments get easier.
Response: deliver remotely from Mumbai and bring specialists in under the visa scheme. Confirm tax treatment per contract. |
| Entity & taxNZ company · GST · company tax | CheckFrom an adviser guide last updated in Nov 202426. Not re-verified with IRD. | At least one director resident in New Zealand, or in Australia if also a director of an Australian company. GST at 15%, with registration required once supplies exceed NZ$60,000 in 12 months. Company tax at a flat 28%. Cross-border services and software have special GST rules26. | Response: confirm with a New Zealand tax adviser before setting prices and opening the entity. See pricing & tax. |