• Home /
• Privacy Act 2020 /
• Secondary legislation: codes of practice /
• Credit Reporting Privacy Code 2020

Privacy Act 2020

About the code

The Credit Reporting Privacy Code 2020 (CRPC) applies specific rules to credit reporters to ensure the protection of individual privacy. It addresses the credit information collected, held, used, and disclosed by credit reporters.

For credit reporters the code takes the place of the information privacy principles.

In March 2026 we issued Amendment No 1 to the code to reflect new Information Privacy Principle 3A (IPP3A).

Request your credit report 

There are three main credit reporting companies in New Zealand; Centrix, Equifax (formerly Veda), and Experian (formerly illion, formerly Dun & Bradstreet). You can ask for your credit report from each company online:

• Centrix
• Equifax
• Experian

Summary of rights

The Credit Reporting Privacy Code 2020 gives you specific rights. These rights are summarised in the below document. 

Credit Reporting Summary of Rights (opens to PDF, 344KB)

You can access the summary of rights in the following languages:

Credit reporters must display this summary on their websites and must provide it to people in certain circumstances, including when responding to a person's request for a copy of their credit report.

*A note about 2012 changes

Major changes to New Zealand's credit reporting system came into effect on 1 April 2012. The first change to the law allowed a "positive" credit reporting system to operate in the country for the first time. Until then, New Zealand had run a negative credit reporting system that recorded defaults, bankruptcies and court judgments. 

The second key change would enable consumers to “freeze” their credit reports if they are a victim of fraud. This is also called “suppressing” credit reports. It will protect people at risk from having new credit accounts opened in their name.

Other changes that came into effect included:

• Credit reporters prohibited from listing small defaults of less than $100 - traditionally an area of consumer dispute;
• Credit providers permitted to use credit reports to "pre-screen" direct marketing lists - to help ensure that marketing for new credit products was responsible and not sent to those who could not afford more debt; and
• Credit reporters would be required to send annual compliance reviews or assurance reports to the Privacy Commissioner to encourage systematic improvements to procedures to safeguard credit information and to maintain public confidence in the system.