Does the Privacy Act apply to organisations based overseas?

Any organisation that collects personal information while operating in New Zealand must comply with the Privacy Act. This means even if an organisation is based overseas, they will have all the same legal obligations as New Zealand-based organisations. They will need to comply with the Privacy Act principles which set out how personal information must be handled, and must have a privacy officer, provide privacy statements etc.

To work out whether an organisation is operating in New Zealand, or 'carrying on business' here, think about whether the organisation is undertaking activities that involve the collection, use and disclosure of personal information on a repetitive, systematic or continuing basis, whether the organisation has a website offering goods or services to countries including New Zealand, or specifically targeted at New Zealanders, the activities take place or are acted upon in New Zealand, or the organisation is the holder of trademarks or has registered web domains in New Zealand.

Updated October 2025