Act · 2020 · Tier 1
Privacy Act 2020
Also known as: the Privacy Act
What it is
The Privacy Act 2020 is New Zealand's primary privacy statute. It governs how agencies (in the Act's sense — any organisation or person, including real estate agencies and individuals acting in their capacity as licensees) collect, store, use, and disclose personal information. The Act is administered by the Office of the Privacy Commissioner (OPC). It replaced the Privacy Act 1993 and modernised several aspects, most notably by introducing a mandatory notification regime for serious privacy breaches and by restricting transfers of personal information overseas.
What it covers
- Personal information — information about an identifiable individual. Names, addresses, email, phone numbers, photos of people, voice recordings, documents that identify a person.
- Collection — how the information is gathered, including from the person directly and from third parties.
- Use — what the agency does with the information internally.
- Disclosure — sharing with third parties.
- Access and correction — your rights to request your own information and to correct errors.
- Overseas transfer — rules on sending personal information to parties outside NZ.
- Notifiable privacy breaches — mandatory reporting of serious breaches to OPC and affected individuals.
The Act applies to real estate agencies, building inspectors, photographers, staging companies, and any other party who collects personal information in the course of property transactions. It applies to individuals acting in their professional capacity as well as to organisations.
What it gives you
- The right to know why information is being collected. Agencies must tell you the purpose before or at the time of collection.
- A limit on collection. Only information necessary for a lawful, stated purpose can be collected.
- Protection from unfair or unreasonably intrusive collection. This is IPP 4. Its scope covers what can be photographed, recorded, and asked about.
- The right to see and correct your information. IPP 6 and IPP 7.
- A limit on disclosure. Information cannot be shared beyond the original purpose without consent or statutory authority.
- A complaint pathway. Free complaints to the Office of the Privacy Commissioner.
The thirteen Information Privacy Principles
The Privacy Act is structured around 13 Information Privacy Principles (IPPs). They are the operational content of the statute. The full text is at sections 22 to 23. In brief:
IPP 1 — Purpose of collection
"Personal information must not be collected by an agency unless the information is collected for a lawful purpose connected with a function or activity of the agency, and the collection of the information is necessary for that purpose."
Our reading: There must be a specific, lawful purpose, and the information collected must be necessary for that purpose. A building inspection's purpose is to assess the building. Photographs of occupants' belongings, children's bedrooms, or personal clothing are not necessary for that purpose. IPP 1 is frequently engaged where an agent or inspector collects information that does not serve their stated function.
IPP 3 — Notification of collection
The agency must tell you what information is being collected, why, who will have it, and your rights to access and correct it. This must happen before or at the time of collection.
IPP 4 — Manner of collection
"Personal information must not be collected by an agency by means that, in the circumstances of the case — (a) are unlawful; or (b) are unfair; or (c) intrude to an unreasonable extent upon the personal affairs of the individual concerned."
Our reading: This is the provision most often engaged in real estate contexts. Photographing private living spaces, including children's bedrooms, without a clear inspection purpose meets the "unreasonable intrusion" test. Recording conversations without reasonable notice (NZ is one-party consent for audio recording, so the recorder need not always disclose, but publishing or sharing a recording raises separate issues — see below).
IPP 10 — Limits on use
Information collected for one purpose cannot be used for a different purpose without authority. Photos taken for a building inspection cannot be used in marketing, or shared with unrelated parties, without further authority.
IPP 11 — Limits on disclosure
"An agency that holds personal information must not disclose the information to any other agency or person..."
Our reading: IPP 11 lists specific exceptions (directly related purpose, consent, serious threat, etc.) but the default is that personal information cannot be disclosed beyond the original purpose. Distribution of inspection reports that contain photos of occupants' personal belongings to prospective purchasers goes beyond the inspection purpose, and engages IPP 11 — both as to the occupants depicted and as to any identifiable third parties.
The other IPPs cover source of collection (IPP 2), information storage and security (IPP 5), access (IPP 6), correction (IPP 7), accuracy (IPP 8), retention (IPP 9), unique identifiers (IPP 13), and disclosures outside New Zealand (IPP 12 and related provisions).
Recording conversations under NZ law
NZ is a one-party consent jurisdiction for audio recording. A person who is a party to a conversation may record it without obtaining the other party's consent. This is a criminal-law position under the Crimes Act 1961, not a privacy-law position.
However, sharing or publishing a recording engages the Privacy Act. If a recording is made for personal use only, the Act's domestic-affairs exception may apply. Once the recording is shared beyond that scope — provided to a lawyer, tribunal, or platform — IPP 11 governs whether and how disclosure is permissible.
The practical guidance: record your own conversations for your own protection where it is lawful, but treat the act of sharing those recordings as a separate decision. See also Evidence Act 2006 on admissibility.
How the Act is applied in practice
The Office of the Privacy Commissioner receives thousands of complaints annually. Most are resolved through conciliation. A smaller number proceed to the Human Rights Review Tribunal, whose monetary jurisdiction mirrors the District Court's civil limit — currently up to $350,000. Damages awards are relatively rare, and almost always well below that ceiling. Hammond v Credit Union Baywide [2015] NZHRRT 6, one of NZ's most-cited privacy awards, totalled $168,000 (humiliation + pecuniary loss + legal costs). The more common remedy is an order to cease the conduct and to return or destroy the information.
For real estate contexts specifically, the Privacy Commissioner has published guidance on real estate agents and privacy obligations. The guidance emphasises that agents are data handlers subject to the IPPs, and that the property-sale context does not weaken the Act's requirements.
Common misuses
"We need to photograph everything for the report"
The inspection purpose determines what can be photographed. A building inspector does not need photographs of personal belongings, occupant's clothing, or children's bedrooms to assess the building. "For the report" is not a Privacy-Act-compliant purpose where the photograph does not document a building issue.
"You signed a general consent, so we can use any information"
General consents given in agency agreements do not override the IPPs. A consent must be informed, specific, and freely given. Consent to "use information for the sale" does not extend to disclosure of information that does not serve the sale purpose. IPP 11 cannot be signed away in a standard-form agreement that the vendor did not negotiate.
"The Privacy Act only applies to big companies"
The Act applies to any agency, including individuals in their professional capacity and small businesses. Real estate salespersons are themselves agencies under the Act.
When you might cite this Act
- Inspection photography that captures private living spaces. IPPs 1, 4, and 11. Particularly where a minor child's bedroom or personal belongings are photographed.
- Disclosure of documents beyond the original purpose. A disclosure statement shared with parties beyond the transaction, or repurposed for marketing, engages IPP 11.
- Requesting your own information held by the agency. IPP 6 gives you the right to access, at reasonable cost if any. The agency must respond within 20 working days.
- Correcting inaccurate information. IPP 7.
- Notifiable breaches. If an agency loses your information, they must notify you and OPC where the breach is likely to cause serious harm.
Related rules
- Real Estate Agents Act 2008 — licensee duties operate alongside the Privacy Act.
- Professional Conduct and Client Care Rules 2012 — Rule 9.2 on misleading conduct overlaps with privacy obligations on accuracy.
- Harmful Digital Communications Act 2015 — applies specifically where digital communications cause harm, including photographs of minors.
- Evidence Act 2006 — governs admissibility of recorded material in proceedings.
Authoritative sources
- Full text: Privacy Act 2020 — legislation.govt.nz
- Office of the Privacy Commissioner: privacy.org.nz
- Information Privacy Principles (IPPs) — plain language: privacy.org.nz
- Real estate sector guidance: OPC publishes sector-specific material periodically.