Home
Acts
Customer and Product Data Act 2025
Administrative matters
Chief executive may approve persons to have principal role in developing standards
100: How approval is given

Part 1:
Preliminary provisions

Purpose

Overview

Part 2:
Regulated data services

Main obligations

Customer data

14Data holder must provide customer data to customer 15Data holder must provide customer data to accredited requestor if customer’s authorisation is confirmed 16Data holder may or must refuse request for data in certain circumstances 17Sections 14 and 15 do not prevent request to access personal information being made in some other manner

Designated actions

18Data holder must perform certain actions on customer’s request 19Data holder must perform certain actions on accredited requestor’s request if customer’s authorisation is confirmed 20Data holder may or must refuse to perform actions in certain circumstances

Joint customers

21How data holders and accredited requestors must deal with joint customers

Product data

22Data holder must provide product data to any person 23Data holder may refuse request for data in certain circumstances

Additional obligations

Secondary users

24How data holders and accredited requestors must deal with secondary users 25Regulations may require requests to be made or authorisations to be given only by secondary users

Valid requests

26When request is valid

Electronic system

27Data holder must operate electronic system for providing regulated data services 28Electronic system must comply with prescribed technical or performance requirements 29Chief executive may require data holder to test electronic system 30Offence for failing to comply with notice to test electronic system

Requirements for requests, providing services, and making information available

31Data holders must comply with requirements for requests, providing services, and making information available 32Requirements for data holders in regulations or standards 33Accredited requestors must comply with requirements for making information available 34Requirements in regulations or standards for accredited requestors to make information available 35Contravention of specified disclosure requirement is infringement offence 36Accredited requestor must not act if reasonable grounds to believe authorisation or instruction is given under threat of physical or mental harm

Part 3:
Protections

Authorisation

37Giving authorisation 38Ending authorisation 39Authorisation must be confirmed 40Customer or secondary user must be able to control authorisation 41Accredited requestor must comply with prescribed duties in respect of authorisation 42Authorisation must not be required as condition of providing product

Restriction on who may request regulated data service

43Only customer, secondary user, or accredited requestor may request regulated data service 44Offence for contravention of request restriction 45Verification of identity of person who makes request

Record keeping

46Data holder must keep records about regulated data service 47Accredited requestor must keep records about regulated data service

Complaints

48Data holders and accredited requestors must have customer complaints process 49Data holder or accredited requestor must be member of dispute resolution scheme (if scheme has been prescribed)50Rules of scheme may be changed to provide for complaints about regulated data services

Privacy Act 2020

51Access request not IPP 6 request but contravention is interference with privacy 52Certain contraventions relating to storage and security treated as breaching information privacy principle 5

Part 4:
Regulatory and enforcement matters

Regulatory powers

53Chief executive may require person to supply information or produce documents 54Person has privileges of witness in court 55Effect of proceedings 56Effect of final decision that exercise of powers under section 53 unlawful 57Offence for failing to comply with notice to supply information or produce documents

Duties to take remedial action

58Data holder or accredited requestor must take prescribed steps to avoid, mitigate, or remedy loss or damage caused by contravention 59Person who has suffered loss or damage may recover amount as debt due 60Other remedies or powers not limited

Prohibition against holding out

61Prohibition against holding out

Infringement offences

62Infringement offences 63When infringement notice may be issued 64Revocation of infringement notice before payment made 65What infringement notice must contain 66How infringement notice may be served 67Payment of infringement fees 68Reminder notices

Civil liability

69Civil liability remedies available under this subpart

Pecuniary penalty order

70When High Court may make pecuniary penalty order 71Maximum penalty (Tier 1)72Maximum penalty (Tier 2)73Considerations for court in determining pecuniary penalty 74Limit on pecuniary penalty for multiple contraventions of same or substantially similar nature

Declaration of contravention

75Declaration of contravention 76Purpose and effect of declaration of contravention 77What declaration of contravention must state

Compensatory orders

78When court or Disputes Tribunal may make compensatory orders 79Terms of compensatory orders

Injunctions

80Court may grant injunctions 81When court may grant restraining injunctions 82When court may grant performance injunctions 83Chief executive's undertaking as to damages not required

Rules of procedure

84Rules of civil procedure and civil standard of proof apply 85Limit on proceedings

Relationship between proceedings and orders

86More than 1 civil liability remedy may be given for same conduct 87Only 1 pecuniary penalty order may be made for same conduct 88No pecuniary penalty and criminal penalty for same conduct

Defences

89General defences for person in contravention 90Defence for contraventions due to technical fault 91Defence for providing data in compliance or purported compliance with this Act

Jurisdiction

92Jurisdiction of High Court 93Jurisdiction of District Court 94Jurisdiction of Disputes Tribunal

Part 5:
Administrative matters

Chief executive’s functions

95Chief executive’s functions

Chief executive may approve persons to have principal role in developing standards

96When person must be approved under this subpart 97Chief executive may approve person 98Criteria for approving person 99Approval may extend to other activities 100How approval is given 101Chief executive may change terms and conditions or revoke approval at any time 102Subpart does not limit or affect chief executive’s powers 103Approved person must provide annual report on activities

Designation regulations

104Designation regulations 105Minister must have regard to certain matters when recommending designation regulations 106Minister must consult on proposed designation 107Contents of designation regulations

Accreditation of requestors

108Application for accreditation 109How application is made 110Application may be made before designation regulations fully in force 111Chief executive must verify applicant’s identity 112Decision by chief executive 113Notice of decision 114Application to modify accreditation 115Chief executive may modify terms or conditions on own motion 116Duration of accreditation 117Renewal of accreditation 118When chief executive may suspend or cancel accreditation

Appeals

119Appeals against accreditation decisions

Crown organisations

120Crown organisations may be customer, data holder, or accredited requestor

Register

121Register of participants in customer and product data system 122Purposes of register 123Operation of register 124Persons that will become data holders when designation comes into force must provide information to chief executive 125Other data holders must provide information to chief executive 126Contents of register that is publicly available 127Contents of register that is available to data holders and accredited requestors (other than information publicly available under section 126)

Information sharing

128Sharing of information with certain law enforcement or regulatory agencies 129Conditions that may be imposed on providing information under this subpart 130Restriction on publication, disclosure, or use

Regulations, standards, and exemptions

Regulations

131General regulations 132Minister must have regard to certain matters when recommending regulations under section 131 133Regulations relating to fees and charges 134Miscellaneous provisions relating to fees and charges 135Levies payable by data holders and accredited requestors 136Miscellaneous provisions relating to levies 137Minister must consult on proposed regulations

Standards

138Standards 139Chief executive must comply with requirements before making standard 140Chief executive’s consultation on proposed standards

Exemptions

141Exemptions 142Effect of breach of term or condition of exemption

Miscellaneous

143No contracting out 144Chief executive’s warnings, reports, guidelines, or comments protected by qualified privilege 145Notices 146Service of notices

Consequential amendments

Amendment to Disputes Tribunal Act 1988

147Principal Act 148Schedule 1 amended

Amendments to Privacy Act 2020

149Principal Act 150Section 75 amended (Referral of complaint to another person)151Section 208 amended (Consultation)

Amendment to Summary Proceedings Act 1957

152Principal Act 153Section 2 amended (Interpretation)

Schedule 1:
Transitional, savings, and related provisions

Customer and Product Data Act 2025

Administrative matters - Chief executive may approve persons to have principal role in developing standards

100: How approval is given

You could also call this:

"The boss writes a letter to say you're approved and tells everyone about it"

The person in charge can approve someone by giving them a written notice. This notice will tell you all about the approval, including what rules it applies to. The person in charge must also let everyone know about this approval. They do this by putting the notice in two places: in a special book called the Gazette, and on a website that the Ministry looks after.

This text is automatically generated. It might be out of date or be missing some parts. Find out more about how we do this.

This page was last updated on 1 May 2025

View the original legislation for this page at https://legislation.govt.nz/act/public/1986/0120/latest/link.aspx?id=LMS1000426.

Topics:

Government and voting > Government departmentsRights and equality > Privacy

99: Approval may extend to other activities, or

"The boss can let helpers do extra jobs without asking permission first"

101: Chief executive may change terms and conditions or revoke approval at any time, or

"Boss can change rules or take away permission anytime"

Part 5Administrative matters
Chief executive may approve persons to have principal role in developing standards

100How approval is given

The chief executive may approve a person by giving written notice to the person.
The notice must set out the terms and conditions of the approval, including the designation regulations in respect of which the appointment applies.
The chief executive must publish the notice—
in the Gazette; and
on an internet site maintained by or on behalf of the Ministry.