Back to Blog

Why AI data protection matters for NZ businesses

AI use is already happening inside most organisations, whether leadership has approved it or not. For New Zealand businesses, the biggest risk usually isn’t AI itself. It’s staff using it without clear rules, approved tools, or oversight. The Privacy Act 2020 still applies when AI is involved, and a few practical steps can reduce risk without shutting innovation down.AI has moved from “something to think about later” to something people are already using at work.That might be for draftin...

IPP3A privacy changes in NZ: what businesses need to know

From 1 May 2026, New Zealand organisations have a new Privacy Act obligation under Information Privacy Principle 3A, known as IPP3A.IPP3A applies when your organisation collects personal information about someone from a source other than the person themselves. This is called indirect collection.In practical terms, if your business collects information from third parties, referrals, business partners, public sources, recruiters, background checks, marketing lists, or other external sources, you m...

Privacy Act for businesses in New Zealand: what you need to know

The Privacy Act 2020 applies to every business in New Zealand, no matter how small.If you collect or store personal information about customers, staff, or suppliers, you have responsibilities under the law.For most businesses, compliance starts with a few practical steps:● Know what personal information you collect.● Understand why you collect it.● Make sure it's stored securely.● Limit who can access it.● Only keep it for as long as necessary.● Appoint a Privacy Officer.In my experi...