Privacy Act 2020 NZ: what firms running KYC checks need to know

What it is

The Privacy Act 2020 replaced the 1993 Act. It sets information privacy principles (IPPs) for collecting, storing, using, disclosing and retaining personal information, and makes notifying serious privacy breaches mandatory. The Privacy Commissioner can issue codes of practice that change how the IPPs apply.

IPP 3A is new. It closes a gap the European Union flagged in its review of New Zealand's adequacy status: notice when information comes from someone other than the person. The Biometric Processing Privacy Code 2025 replaces the IPPs with modified rules wherever an agency uses technology to compare or analyse biometric information, such as a face.

What you have to do

These are the duties that touch onboarding, identity verification and screening.

1. Tell clients what you collect and why

   When you collect directly from a client, IPP 3 requires reasonable steps to make them aware of the collection, its purpose, the recipients, and their rights of access and correction.

   Intake
2. Give notice of indirect collection

   Since 1 May 2026, IPP 3A requires you to tell a person when you collect their information from another source, as soon as reasonably practicable. Exceptions include where the person already knows, the information is publicly available, or notice would prejudice the maintenance of the law. Check which apply to your screening and data-source checks.

   Screen
3. Assess biometric checks before you use them

   Rule 1 of the Code allows biometric collection only if it is for a lawful purpose, necessary and effective, there is no less privacy-intrusive alternative that would work as well, reasonable safeguards are in place, and you believe on reasonable grounds it is proportionate. The proportionality assessment must consider cultural impacts on Māori.

   Verify
4. Give a biometric notice and limit retention

   Rule 3 requires the client to be told, before or at collection and in a clear and conspicuous way, that biometric information is being collected, each specific purpose, and whether an alternative to biometric processing is available. Other matters, including retention, can follow soon after. Rule 9 then limits retention to what the lawful purposes require.

   Verify
5. Report serious privacy breaches

   If a breach has caused or is likely to cause serious harm, notify the Privacy Commissioner and affected people as soon as practicable. The OPC asks for notice ideally within 72 hours of becoming aware. Failing to notify the Commissioner is an offence with a fine of up to $10,000.

   Governance

What happens when

1. 1 Dec 2020In force

   Privacy Act 2020 comes into force Source

2. 21 Jul 2025In force

   Biometric Processing Privacy Code 2025 issued Source

3. 3 Nov 2025In force

   Biometric Processing Privacy Code in force for new biometric processing Source

4. 1 May 2026In force

   IPP 3A on indirect collection in force; Code Amendment No 1 aligns the Code with it Source

5. 3 Aug 2026In force

   Grace period ends for agencies already using biometrics Source

6. By 3 Nov 2028Commencing

   Privacy Commissioner to start a review of the Biometric Processing Privacy Code Source

Questions people ask

Where StackGo fits

IdentityCheck's identity check uses biometric verification, so NZ firms that use it are carrying out biometric processing under the Code. The Rule 1 assessment, the notices and the retention decisions are yours to make.

See how the workflows run Book a demo