Current position
Overview
No AI-specific legislation has been enacted or formally tabled. The government has published an Algorithm Charter for public sector agencies. Courts have issued guidance on the use of generative AI.
Regulatory developments
Latest updates
Latest event import:
Updates sourced from Digital Policy Alert ↗. The latest available entries for this jurisdiction.
public lawsuit
Auckland District Court issued ruling against HelloFresh including NZD 845,000 fine over misleading subscriptions
Source: Digital Policy Alert · View update ↗
On 17 October 2025, the Auckland District Court issued a ruling against HelloFresh, fining the company NZD 845,000 for misleading subscription practices. The ruling found that HelloFresh breached the Fair Trading Act by misleading consumers into reactivating subscriptions. It was stated that the meal-kit company conducted nearly 1 million cold calls over 18 months, reactivating around 80,000 subscriptions by offering discount vouchers without clarifying that accepting them could restart paid subscriptions. It was also stated that the practices were embedded in HelloFresh’s processes.
outline
Office of Privacy Commissioner issued statement on information sharing for child safety and wellbeing
Source: Digital Policy Alert · View update ↗
On 9 October 2025, the Office of the Privacy Commissioner (OPC) of New Zealand issued a public statement clarifying that the Privacy Act 2020 does not prevent the sharing of information where there is a safety or well-being concern for a child. The statement followed the Government’s acceptance of all recommendations from the 2022 Dame Karen Poutasi Review on changes to improve the system of safety nets for preventing harm in the children's system. It stated that the Oranga Tamariki Act allows lawful information sharing to keep children safe and that Sections 15, 16, and 66C of the Act provide legal protection for those acting in good faith. The Commissioner stressed that urgent concerns about harm should take priority and that good privacy practice ensures information is shared correctly.
law
Privacy Amendment Act, including cross-border data transfer regulation, enters into force
Source: Digital Policy Alert · View update ↗
On 23 September 2025, the Privacy Amendment Act's provisions on cross-border data transfer regulation entered into force. The Act provides that the Privacy Commissioner may assess the privacy protections in a third country to ensure that that country provides comparable safeguards for the purposes of cross-border data transfers. The Act provides for data transfers on an individual basis and on the basis of membership of a block of countries.
law
Privacy Amendment Bill, including information privacy principle was signed by Governor General
Source: Digital Policy Alert · View update ↗
On 22 September 2025, the Governor General of New Zealand signed the Privacy Amendment Bill into law, which introduces notification requirements for the indirect collection of personal information. The law requires agencies to notify individuals when collecting personal information from third parties, with exceptions for data collected before 1 May 2026. The notification must also include the purpose for the collection and the intended recipients of the information. The individual must be made aware of the name and address of both the collecting and the holding agency. If the collection is required by law, the specific law must be identified. The individual must also be informed of their rights to access and correct their information. The notification should occur as soon as reasonably practicable after the collection. The requirement does not apply if the individual is already aware of all these matters. There are several exemptions where notification is not necessary, including situations where non-compliance would not prejudice the individual's interests, the information is publicly available, or notification would prejudice law enforcement, public safety, security, or international relations.
law
Privacy Amendment Bill, including cross-border data transfer regulation was signed by Governor General
Source: Digital Policy Alert · View update ↗
On 22 September 2025, the Governor General of New Zealand signed the Privacy Amendment Bill into law. The Bill provides that the Privacy Commissioner may assess the privacy protections in a third country to ensure that that country provides comparable safeguards for the purposes of cross-border data transfers. The Bill provides for data transfers on an individual basis and on the basis of membership of a block of countries.
Showing 5 of 9 available API entries. Dates and summaries are supplied by Digital Policy Alert.