Home
Acts
Privacy Act 2020
Information privacy principles and codes of practice
Information privacy principles
28: IPPs 2, 3, and 4(b) do not apply to personal information collected by intelligence and security agencies

Part 1:
Preliminary provisions

Preliminary matters

3Purpose of this Act 4Application of this Act 5Transitional, savings, and related provisions 6Act binds the Crown

Interpretation and related matters

7Interpretation 8Meaning of New Zealand agency 9Meaning of overseas agency 10Personal information held by agency if held by officer, employee, or member of agency 11Personal information treated as being held by another agency in certain circumstances 12Actions of, and disclosure of information to, staff of agency, etc

Part 2:
Privacy Commissioner

Appointment of Privacy Commissioner

13Privacy Commissioner 14Deputy Privacy Commissioner 15Holding of other offices 16Superannuation or retiring allowances

Functions of Privacy Commissioner

17Functions of Commissioner 18Other functions of Commissioner 19Responsible Minister must present copy of report on operation of Act to House of Representatives 20Duty to act independently 21Commissioner to have regard to certain matters

Part 3:
Information privacy principles and codes of practice

Information privacy principles

22Information privacy principles 23Application of IPPs in relation to information held overseas 24Relationships between IPPs and other New Zealand law 25IPPs 1 to 4 do not apply to personal information collected before 1 July 1993 26Restricted application of IPP 13 to unique identifiers assigned before 1 July 1993 27Restricted application of IPPs to personal information collected or held for personal or domestic affairs 28IPPs 2, 3, and 4(b) do not apply to personal information collected by intelligence and security agencies 29IPPs 6 and 7 do not apply to certain information 30Commissioner may authorise collection, use, storage, or disclosure of personal information otherwise in breach of IPP 2 or IPPs 9 to 12 31Enforceability of IPPs

Codes of practice

32Codes of practice in relation to IPPs 33Issue of code of practice 34Urgent issue of code of practice 35Commencement of code 36Application of Legislation Act 2019 to codes 37Amendment and revocation of codes of practice 38Effect of codes of practice

Part 4:
Access to and correction of personal information

Access to personal information

Correction of personal information

58Interpretation 59Individuals may make correction requests 60Urgency 61Assistance 62Transfer of correction request 63Decision on request to correct personal information 64Decision on request to attach statement of correction 65Extension of time limits

Charges

66Charges 67Commissioner may authorise public sector agency to impose charge

Part 5:
Complaints, investigations, and proceedings

68Interpretation 69Interference with privacy of individual

Complaints

70Complaints 71Who may make complaint 72Form of complaint 73Procedure on receipt of complaint 74Commissioner may decide not to investigate complaint 75Referral of complaint to another person 76Referral of complaint to overseas privacy enforcement authority 77Exploring possibility of settlement and assurance without investigating complaint 78Referral of complaint to Director without conducting investigation

Investigations by Commissioner

79Application of this subpart 80Commencing investigation 81Conducting investigation 82Commissioner may regulate own procedure 83Exploring possibility of settlement and assurance during investigation 84Referral of complaint to Director without completing investigation 85Compulsory conferences of parties to complaint 86Power to summon persons 87Power to require information and documents 88Disclosure of information may be required despite obligation of secrecy 89Protection and privileges of persons required to provide information, etc 90Disclosed information privileged 91Procedure after completion of investigation relating to access to personal information 92Access direction 93Procedure after completion of investigation relating to charging 94Procedure after completion of other investigations 95Special procedure relating to intelligence and security agency 96Commissioner to report breach of duty or misconduct

Proceedings before Human Rights Review Tribunal

Part 6:
Notifiable privacy breaches and compliance notices

Notifiable privacy breaches

112Interpretation 113Assessment of likelihood of serious harm being caused by privacy breach 114Agency to notify Commissioner of notifiable privacy breach 115Agency to notify affected individual or give public notice of notifiable privacy breach 116Exceptions to or delay in complying with requirement to notify affected individuals or give public notice of notifiable privacy breach 117Requirements for notification 118Offence to fail to notify Commissioner 119Section 211 does not apply to processes and proceedings relating to failure to notify notifiable privacy breach 120Liability for actions of officers, employees, agents, and members of agencies 121Knowledge of officers, employees, agents, and members of agencies to be treated as knowledge of employers, principal agencies, and agencies 122Publication of identity of agencies in certain circumstances

Compliance notices

123Compliance notices 124Issuing compliance notice 125Form of compliance notice 126Agency response to compliance notice 127Commissioner may vary or cancel compliance notice 128Commissioner’s power to obtain information 129Publication of details of compliance notice

Proceedings

130Enforcement of compliance notice 131Appeal against compliance notice or Commissioner’s decision to vary or cancel notice 132Interim order suspending compliance notice pending appeal 133Remedies, costs, and enforcement 134Application of Human Rights Act 1993 135Commissioner may be represented in proceedings

Part 7:
Sharing, accessing, and matching personal information

Information sharing

136Purpose of this subpart 137Relationship between subpart 1 and other law relating to information disclosure 138Interpretation 139Information sharing between agencies 140Information sharing within agencies 141Parties to information sharing agreement 142Agreement may apply to classes of agencies 143Lead agency 144Form and content of information sharing agreement 145Governor-General may approve information sharing agreement by Order in Council 146Requirements for Order in Council 147Further provisions about Order in Council 148Status of Order in Council 149Matters to which relevant Minister must have regard before recommending Order in Council 150Consultation on proposed information sharing agreement 151Commissioner may prepare and publish report on approved information sharing agreement 152Requirement to give notice of adverse action 153When requirement to give notice of adverse action applies 154Responsibilities of lead agency 155Report of lead agency 156Commissioner may specify frequency of reporting by lead agency 157Amendment of approved information sharing agreement 158Review of operation of approved information sharing agreement 159Report on findings of review 160Relevant Minister must present copy of report under section 159(1) and report setting out Government's response to House of Representatives 161Power to amend Schedule 2 by Order in Council

Identity information

162Purpose of this subpart 163Relationship between this subpart and other law relating to information disclosure 164Interpretation 165Access by agencies to identity information 166Manner and form of access 167Annual reporting requirement 168Power to amend Schedule 3 by Order in Council

Law enforcement information

169Purpose of this subpart 170Relationship between this subpart and other law relating to information disclosure 171Interpretation 172Access by accessing agencies to law enforcement information 173Power to amend Schedule 4 by Order in Council

Authorised information matching programmes

174Purpose of this subpart 175Application of this subpart 176Relationship between this subpart and other law relating to information disclosure 177Interpretation 178Information matching agreements 179Use of results of authorised information matching programme 180Extension of time limit 181Notice of adverse action proposed 182Reporting requirements 183Reports on authorised information matching programmes 184Reports on information matching provisions 185Responsible Minister must present copy of report under section 184 and report setting out Government’s response to House of Representatives 186Avoidance of controls on information matching through use of exceptions to information privacy principles 187Avoidance of controls on information matching through use of official information statutes 188Power to amend Schedule 5 by Order in Council 189Power to amend Schedule 6 by Order in Council 190Amendments to other enactments related to this subpart 191Repeal of section 190 and Schedule 7

Part 8:
Prohibiting onward transfer of personal information received in New Zealand from overseas

192Interpretation 193Prohibition on transfer of personal information outside New Zealand 194Commissioner's power to obtain information 195Transfer prohibition notice 196Commissioner may vary or cancel transfer prohibition notice 197Offence in relation to transfer prohibition notice 198Appeals against transfer prohibition notice 199Application of Human Rights Act 1993 200Power to amend Schedule 8 by Order in Council

Part 9:
Miscellaneous provisions

General

201Privacy officers 201AResponsibility under Parts 4 to 6 for interdepartmental executive board 202Commissioner may require agency to supply information 203Inquiries 204Powers relating to declaratory judgments 205Protection against certain actions 206Commissioner and staff to maintain secrecy 207Commissioner may share information with overseas privacy enforcement authority 208Consultation 209Exclusion of public interest immunity 210Adverse comment

Liability and offences

211Liability of employers, principals, and agencies 212Offences

Regulations

213Regulations: prescribed binding schemes 214Regulations: prescribed countries 215Other regulations

Repeal, revocation, and consequential amendments

216Repeal and revocation 217Consequential amendments 218Repeal of section 217 and Schedule 9

Schedule 1:
Transitional, savings, and related provisions

Schedule 2:
Approved information sharing agreements

Schedule 3:
Identity information

Schedule 4:
Law enforcement information

Schedule 5:
Information matching provisions

Schedule 6:
Information matching rules

Schedule 7:
Amendments to other enactments related to subpart 4 of Part 7

Schedule 8:
Basic principles of national application set out in Part Two of OECD Guidelines

Schedule 9:
Consequential amendments

Privacy Act 2020

Information privacy principles and codes of practice - Information privacy principles

28: IPPs 2, 3, and 4(b) do not apply to personal information collected by intelligence and security agencies

You could also call this:

"Some privacy rules don't apply to spy agencies collecting personal information."

When you look at the rules for keeping personal information private, there are some exceptions. IPPs 2, 3, and 4(b) are some of these rules that do not apply to personal information collected by intelligence and security agencies. This means that intelligence and security agencies do not have to follow these specific rules when they collect personal information.

You can find more information about this by looking at the law from 1986 for comparison. This law is related to how personal information is handled. It is good to know how your personal information is protected.

This text is automatically generated. It might be out of date or be missing some parts. Find out more about how we do this.

This page was last updated on 6 October 2025

View the original legislation for this page at https://legislation.govt.nz/act/public/1986/0120/latest/link.aspx?id=LMS23348.

Topics:

Rights and equality > Privacy

27: Restricted application of IPPs to personal information collected or held for personal or domestic affairs, or

"Some privacy rules don't apply when you collect personal info for personal or family use"

29: IPPs 6 and 7 do not apply to certain information, or

"Some privacy rules don't apply to certain information, like when it's used in investigations or given to the government."

Part 3Information privacy principles and codes of practice
Information privacy principles

28IPPs 2, 3, and 4(b) do not apply to personal information collected by intelligence and security agencies

IPPs 2, 3, and 4(b) do not apply to personal information collected by an intelligence and security agency.

Compare

1993 No 28 s 57