Is My Business an Agency Under NZ Privacy Law?

As more of our day to day processes shift online, customers are growing more concerned about privacy. This is because completing a transaction online involves transmitting sensitive information. It is important to remember that taking responsibility for personal information can have bad consequences if unintended parties get access to it. Therefore, the law sets specific standards for businesses to follow when they handle information of this nature. In legal terms, any organisation that deals with personal information qualifies as an agency and must meet privacy law requirements. However, if you run a small business that deals with little personal information, you may be wondering whether you qualify under this definition. Therefore, this article will explain what an agency is under New Zealand privacy law and how this applies to your business’ privacy obligations.

New Zealand Privacy Law

The Privacy Act sets out New Zealand’s requirements for agencies and how they should handle personal information. This is any information about an identifiable individual, which includes:

• names;
• photos;
• email addresses;
• physical addresses;
• IP addresses; 
• financial details; or
• mobile numbers.

Indeed, this law operates on 13 principles and sets mandatory standards for any agency dealing with this kind of personal data. Accordingly, these information principles apply to all personal information at all of its stages within your business. 

The following table details the specifics of this application to such information.

What Is an Agency?

The simple explanation is that any organisation that collects and uses the personal information of New Zealand citizens qualifies as an agency. Therefore, they must comply with privacy law. Because of this, if your business collects information that can identify a living individual, you need to follow the requirements above. It is important to remember this applies to personal information about both your customers and employees.

However, there are some exceptions to this definition. The Privacy Act does not apply to:

• courts and tribunals doing judicial tasks;
• news media when gathering and reporting news; and
• members of Parliament acting in an official capacity.

Indeed, this definition can also become less clear if you run a sole trader business, where the only person operating the business is you. Do you qualify as an organisation in that scenario? The answer is yes. When dealing with personal information for your business, you qualify as an agency, even as an individual. 

On the contrary, the Privacy Act does not apply if you are using or sharing personal information connected with your personal or household affairs. However, this exception does not apply when you handle personal information in a way that would be highly offensive to a reasonable person.

Managing Your Obligations as an Agency

As an agency, your business must therefore meet its obligations under the Privacy Act. Because of this, you need to handle personal information per the law’s privacy principles. You also need to make sure you:

• have a privacy officer;
• report any data breaches likely to cause serious harm;
• manage obligations to specific kinds of information, such as personal health information;
• follow the law’s requirements for sharing personal information overseas;
• handle unique identifiers with due care; and
• comply with any of the Privacy Commission’s compliance notices.

Key Takeaways

Your business will qualify as an agency under privacy law if it deals with any personal information about an identifiable individual. This applies to all organisations, even if that organisation is just one individual. If you would like more information or help with meeting your privacy obligations as an agency, contact LegalVision’s privacy lawyers on 0800 005 570 or fill out the form on this page.

Frequently Asked Questions