Plain language law

New Zealand law explained for everyone

Customer and Product Data Act 2025

Administrative matters - Designation regulations

107: Contents of designation regulations

You could also call this:

“Rules about what information can be shared and who can use it”

Designation regulations can specify several important things about the Customer and Product Data Act 2025. These regulations can say who needs to follow the rules about sharing data. They can also say what kinds of customer and product information need to be shared.

The regulations can describe what actions people need to take with the data. They can also set up different levels of approval for handling the data. The rules can also say who else can use the data besides the main users.

Sometimes, the rules might let people choose if they want to be part of the data-sharing system. The regulations can include information about bank accounts, even if it has details about other people too.

When it comes to product data, the rules can only include things like what the product is, who can buy it, what the rules for buying it are, how much it costs, and other information that’s usually available to everyone.

The regulations can group different types of approval and secondary users based on things like who has the data, who the customers are, what kind of data it is, and what people are allowed to do with it.

If you’re going to be responsible for sharing data under these rules, you’ll need to give some information to the person in charge.

This text is automatically generated. It might be out of date or be missing some parts. Find out more about how we do this.

This page was last updated on

View the original legislation for this page at https://legislation.govt.nz/act/public/1986/0120/latest/link.aspx?id=LMS710963.

Topics:
Money and consumer rights > Consumer protection Business > Industry rules Business > Fair trading Rights and equality > Privacy
Previous

106: Minister must consult on proposed designation, or

"The Minister must talk to important people before making new rules"

Next

108: Application for accreditation, or

"How to ask to be allowed to make official requests"

Part 5 Administrative matters
Designation regulations

107Contents of designation regulations

  1. Designation regulations may set out all or any of the following:

    Designated persons: data holders

  2. the persons or classes of persons (or both) being designated for the purposes of section 6:

      1. Designated data

    1. the customer data or classes of customer data (or both) being designated as designated customer data for the purposes of 1 or more provisions of this Act:
      1. the product data or classes of product data (or both) being designated as designated product data for the purposes of 1 or more provisions of this Act:

          1. Designated actions

        1. the action or classes of action (or both) being designated as designated actions for the purposes of 1 or more provisions of this Act:

            1. Classes of accreditation

          1. the classes of accreditation that may be granted in relation to the designation regulations:

              1. Secondary users

            1. the persons or classes of persons (or both) being designated as secondary users (including specifying approval or other requirements or eligibility criteria to be met before a person may be a secondary user).

              1. For the purposes of subsection (1)(a), the designation regulations may provide for a person to opt in to being designated for the purposes of section 6 (and, if the regulations do so, the person is designated only if they opt in in the manner specified in the regulations).

              2. Customer data or classes of customer data may be designated under subsection (1)(b) even if the data includes the personal information of any other person.

                Example

                In this example, banks are designated for the purposes of section 6 and information about bank accounts is designated customer data.

                The information includes a customer’s transactional information and information about a customer’s payees, which may include personal information about third parties. This information may be designated (and, accordingly, the bank will have a duty to provide it under section 14 or 15).

              3. For the purposes of subsection (1)(c), data or classes of data may be designated as designated product data only to the extent that they relate to any of the following:

              4. a description of a product or any feature of the product:
                1. any criteria for being eligible to acquire the product:
                  1. any terms or conditions for the supply of the product:
                    1. the price of the product:
                      1. any other data about the product that is of a kind that is ordinarily publicly available.

                        1. For the purposes of subsection (1)(e) and (f), a class of accreditation or a class of secondary user may be defined by reference to any 1 or more of the following:

                        2. data holders or any class of data holders:
                          1. customers or any class of customers:
                            1. designated customer data or any class of that data:
                              1. designated product data or any class of that data:
                                1. designated actions or any class of those actions:
                                  1. any matters relating to the business, operation, or management of an accredited requestor or secondary user to which the class applies (for example, the services that an accredited requestor may provide to a customer):
                                    1. limits or restrictions on the classes of—
                                      1. requests that an accredited requestor may make:
                                        1. requests or authorisations (or both) that a secondary user may make or give:
                                        2. any other circumstances in which—
                                          1. an accredited requestor may make a request:
                                            1. a secondary user may make a request or give an authorisation.

                                            2. See section 124, which requires persons that will become data holders to provide information to the chief executive.