Plain language law

New Zealand law explained for everyone

Customer and Product Data Act 2025

Protections - Restriction on who may request regulated data service

44: Offence for contravention of request restriction

You could also call this:

“You can get in trouble for asking for private information when you're not supposed to”

If you ask for private information about a customer when you’re not allowed to, and you know you’re not allowed to, you’re breaking the law. This is called an offence.

If you’re caught doing this, you could get in big trouble. If you’re an individual person, you might have to go to jail for up to 5 years, or pay a fine of up to $1 million, or both. If you’re not an individual (like if you’re a company), you might have to pay a fine of up to $5 million.

Remember, it’s important to respect people’s privacy and only ask for information when you’re allowed to.

This text is automatically generated. It might be out of date or be missing some parts. Find out more about how we do this.

This page was last updated on

View the original legislation for this page at https://legislation.govt.nz/act/public/1986/0120/latest/link.aspx?id=LMS925548.

Topics:
Rights and equality > Privacy Money and consumer rights > Consumer protection
Previous

43: Only customer, secondary user, or accredited requestor may request regulated data service, or

"Only you, your helper, or a special approved person can ask for your customer data"

Next

45: Verification of identity of person who makes request, or

"Checking who you are when you ask for information"

Part 3 Protections
Restriction on who may request regulated data service

44Offence for contravention of request restriction

  1. A person commits an offence if the person—

  2. requests, or purports to request, a regulated data service that relates to a customer in contravention of section 43; and
    1. knows that they are not permitted to make the request.

      1. A person that commits an offence against this section is liable on conviction,—

      2. in the case of an individual, to imprisonment for a term not exceeding 5 years or to a fine not exceeding $1 million (or both):
        1. in any other case, to a fine not exceeding $5 million.