Live threats
HighClaude Dispatch Flaw Enables Browser Extension RCE on Host OS BreachBrenner Base Tunnel SE Confirms Data Breach; Extortion Group Claims 812 GB Stolen Rule changeOPM proposes to modify OPM/Central-21 system of records and rename employee survey DeadlineNARA proposes revisions to System of Records NARA 44 for reasonable accommodation requests CriticalCISA Adds SonicWall SonicOS SSLVPN Flaw to Known Exploited Vulnerabilities Catalog, Flagging Active Threat BreachIris Ohyama Cloud Service Breach Exposes Personal Data of 7.7 Million Customers Rule changeFinCEN withdraws proposed rule to lower cross‑border funds‑transfer reporting thresholds CriticalAlpine Linux OpenSSH Authentication Bypass (CVE‑2026‑123158) Allows Immediate Server Takeover
Updated 07:35 UTC All intelligence →
Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
EN
JoinJoin
Regulations › Rest of world › New Zealand

Privacy Act

Privacy Act 2020

In force privacy
WhenIn effect since 1 December 2020
Who enforces itOffice of the Privacy Commissioner
Who it applies toEvery agency in New Zealand and overseas agencies carrying on business in New Zealand.
Tell the regulatorNotify the Commissioner as soon as practicable after becoming aware of a notifiable breach (OP… DPO requiredEvery agency must appoint one or more privacy officers RegistrationNo registration Transfers abroadOverseas disclosure allowed only with comparable safeguards, consent after warning, prescribed… Request deadlineRespond no later than 20 working days after receipt (about 28 calendar days) Maximum fineCriminal fines up to NZD 10,000 (e.g. failing to notify a breach)
95%

of New Zealand's 21 requirements are already met by European Union (GDPR). Here is what Privacy Act adds, biggest gaps first.

DPO requiredGovernanceBig gap
GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
Privacy Act adds3 Every agency must appoint one or more privacy officers. s.201 · source ↗

Already covered by GDPR: Reach abroad, Lawful basis, Consent, Sensitive data, Children, Rights, Request deadline, Marketing, DPO qualifications, Registration, DPIA, Records, Retention, Tell the regulator, Tell people, Transfers abroad, Localization, Maximum fine, Criminal liability, Private action.

A gap means Privacy Act is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the mapFollow Regulatory Watch
  • In force
  • Coming into force
  • Sector laws
AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL