Plain language law

New Zealand law explained for everyone

Customer and Product Data Act 2025

Protections - Complaints

48: Data holders and accredited requestors must have customer complaints process

You could also call this:

“Businesses must let customers complain if they're unhappy with how their data is used”

If you are a data holder or an accredited requestor, you need to have a way for customers to complain about how you handle regulated data services. This means you must set up a process that lets customers tell you if they’re unhappy with what you’re doing with their data.

You also need to have a plan for how you’ll look into these complaints and deal with them. It’s important that you make this process as fair, quick, and effective as possible. You should try your best to solve problems in a way that works well for everyone.

If there are any special rules in the regulations about how to handle complaints, you must follow those rules too. This helps make sure that everyone is treated fairly and that complaints are handled in the right way.

This text is automatically generated. It might be out of date or be missing some parts. Find out more about how we do this.

This page was last updated on

View the original legislation for this page at https://legislation.govt.nz/act/public/1986/0120/latest/link.aspx?id=LMS710480.

Topics:
Money and consumer rights > Consumer protection Rights and equality > Privacy Business > Industry rules
Previous

47: Accredited requestor must keep records about regulated data service, or

"Requestors must keep customer data records for 5 years"

Next

49: Data holder or accredited requestor must be member of dispute resolution scheme (if scheme has been prescribed), or

"You must join a group that helps solve problems if the government says so"

Part 3 Protections
Complaints

48Data holders and accredited requestors must have customer complaints process

  1. A data holder or an accredited requestor (A) must have a process that—

  2. allows customers to make complaints about A’s conduct in connection with regulated data services that A provides or requests; and
    1. provides for how those complaints must be investigated and otherwise dealt with.

      1. A must ensure that,—

      2. as far as practicable, the process enables complaints to be investigated and otherwise dealt with fairly, efficiently, and effectively; and
        1. the process meets the requirements provided for by the regulations (if any).