Reading time: 5 minutes

As more of our day to day processes shift online, customers are growing more concerned about privacy. This is because completing a transaction online involves transmitting sensitive information. It is important to remember that taking responsibility for personal information can have bad consequences if unintended parties get access to it. Therefore, the law sets specific standards for businesses to follow when they handle information of this nature. In legal terms, any organisation that deals with personal information qualifies as an agency and must meet privacy law requirements. However, if you run a small business that deals with little personal information, you may be wondering whether you qualify under this definition. Therefore, this article will explain what an agency is under New Zealand privacy law and how this applies to your business’ privacy obligations.

New Zealand Privacy Law

The Privacy Act sets out New Zealand’s requirements for agencies and how they should handle personal information. This is any information about an identifiable individual, which includes:

  • names;
  • photos;
  • email addresses;
  • physical addresses;
  • IP addresses; 
  • financial details; or
  • mobile numbers.

Indeed, this law operates on 13 principles and sets mandatory standards for any agency dealing with this kind of personal data. Accordingly, these information principles apply to all personal information at all of its stages within your business. 

The following table details the specifics of this application to such information.

Collection

Individuals need to know when an agency collects their information and what information you collect. Therefore, you should unintrusively collect direct from the source where possible. This is because you can only collect necessary personal information.

Usage

It is important to tell customers what you will use this information for. You generally cannot change this use after collection unless you have consent. Therefore, you should only use accurate data.

Storage/Retention

You can only keep data for as long as it serves its initial purpose. Therefore, you must dispose of unnecessary information securely, such as shredding physical documents.

Security

Implementing reasonable safeguards for personal information, according to its sensitivity, is crucial.

Disclosure

You generally cannot share personal information unless that was why you collected it. Otherwise, you need consent.

Access

All individuals have the right to access and correct any personal information any agency holds about them.

What Is an Agency?

The simple explanation is that any organisation that collects and uses the personal information of New Zealand citizens qualifies as an agency. Therefore, they must comply with privacy law. Because of this, if your business collects information that can identify a living individual, you need to follow the requirements above. It is important to remember this applies to personal information about both your customers and employees.

However, there are some exceptions to this definition. The Privacy Act does not apply to:

  • courts and tribunals doing judicial tasks;
  • news media when gathering and reporting news; and
  • members of Parliament acting in an official capacity.

Indeed, this definition can also become less clear if you run a sole trader business, where the only person operating the business is you. Do you qualify as an organisation in that scenario? The answer is yes. When dealing with personal information for your business, you qualify as an agency, even as an individual. 

For example, you may individually run a sole trader business selling your craft goods online. Perhaps a customer asks you for access to their personal information, specifically to determine what delivery address you have on file. You are then responsible for giving them this information and honouring their access request.

On the contrary, the Privacy Act does not apply if you are using or sharing personal information connected with your personal or household affairs. However, this exception does not apply when you handle personal information in a way that would be highly offensive to a reasonable person.

Managing Your Obligations as an Agency

As an agency, your business must therefore meet its obligations under the Privacy Act. Because of this, you need to handle personal information per the law’s privacy principles. You also need to make sure you:

  • have a privacy officer;
  • report any data breaches likely to cause serious harm;
  • manage obligations to specific kinds of information, such as personal health information;
  • follow the law’s requirements for sharing personal information overseas;
  • handle unique identifiers with due care; and
  • comply with any of the Privacy Commission’s compliance notices.

This is important because if a customer feels that you have not handled their information the way you should as an agency, they can complain to the Privacy Commission. They can then investigate and issue a compliance notice to fix the issue. If you do not comply with this notice or breach the Privacy Act in another way, you can face penalties up to $10,000.

Key Takeaways

Your business will qualify as an agency under privacy law if it deals with any personal information about an identifiable individual. This applies to all organisations, even if that organisation is just one individual. If you would like more information or help with meeting your privacy obligations as an agency, contact LegalVision’s privacy lawyers on 0800 005 570 or fill out the form on this page.

Frequently Asked Questions

What is personal information?

Personal information is any information about an identifiable individual. This means that if you use the information, either by itself or in combination with other data, you can identify who it is about. Examples include names or addresses.

What is an agency?

An agency is any organisation that handles the personal information of New Zealand citizens. This can include individuals, but in most cases does not apply to the court, the news media, or MPs.

What is the Privacy Act?

The Privacy Act is New Zealand’s primary law that protects the privacy of New Zealand citizens. It regulates how businesses and organisations can collect and use personal information.

About LegalVision: LegalVision is a tech-driven, full-service commercial law firm that uses technology to deliver a faster, better quality and more cost-effective client experience.

The majority of our clients are LVConnect members. By becoming a member, you can stay ahead of legal issues while staying on top of costs. From just $119 per week, get all your contracts sorted, trade marks registered and questions answered by experienced business lawyers.

Learn more about LVConnect

Need Legal Help? Get a Free Fixed-Fee Quote

If you would like to receive a free fixed-fee quote or get in touch with our team, fill out the form below.

Our Awards

  • 2019 Top 25 Startups - LinkedIn
  • 2020 Excellence in Technology & Innovation Finalist – Australasian Law Awards
  • 2020 Employer of Choice Winner – Australasian Lawyer
  • 2021 Fastest Growing Law Firm - Financial Times APAC 500
  • 2021 Law Firm of the Year - Australasian Law Awards
  • 2020 Law Firm of the Year Finalist - Australasian Law Awards