A contact form can create privacy obligations before you’ve won a single customer. Your New Zealand privacy policy needs to explain what happens to personal information, including details collected through bookings, analytics and connected marketing tools.
For small businesses and creative agencies, the main task is matching your policy to your actual processes. A copied template can miss outsourced hosting, automated follow-up or information supplied by another organisation.
Start with the information your website collects, then check the legal notices and safeguards around it.
Key takeaways
- The Privacy Act 2020 generally applies to small businesses handling personal information. Business size alone doesn’t create a general exemption.
- Your policy should explain how you collect and use information, who receives it, how long you keep it, how you protect it, and how people can access or correct it.
- From 1 May 2026, IPP 3A adds notification duties when personal information is collected indirectly, subject to exceptions.
When your website needs privacy information
Names, email addresses, booking details and identifiable customer enquiries are personal information. Website logs and tracking identifiers can also qualify when they relate to an identifiable person.
The information privacy principles govern collection, storage, use and disclosure. They apply beyond your website, including information held in email accounts, spreadsheets and customer relationship management systems.
The law doesn’t prescribe one universal website policy format. However, businesses collecting personal information must meet applicable notification obligations. An accessible policy, supported by notices at collection points, is a practical way to explain your practices.
Every agency must have a privacy officer. In a small business, the owner can take that role.
This is general information, not legal advice. Your obligations depend on your activities, data practices and any applicable sector-specific rules, such as the Health Information Privacy Code.
What your New Zealand privacy policy should cover
Describe collection and purpose
Identify your business and provide contact details. Explain what information you collect and why it’s needed for a lawful purpose connected with your activities. Make sure this reflects your actual collection practices.
Cover forms, bookings, purchases, uploads and enquiries. Include less obvious collection through analytics, spam protection and embedded tools.
When collecting information directly, take reasonable steps to tell people why you collect it, who may receive it, and the name and address of the collecting and holding agencies. Explain whether providing information is voluntary or mandatory, any relevant legal authority, and what may happen if they don’t provide it. Give this notice where people provide their information, as a policy alone may not meet every notification obligation.
Collect only what you need. Avoid requesting sensitive documents through a general quote form when a secure upload process would be more appropriate.
Explain what happens afterwards
Describe how you use information, who receives it, and how long you retain it or how you determine retention periods. Explain overseas processing where relevant.
Include access and correction rights, privacy contact details and a complaint route. Keep security descriptions accurate without exposing technical details.
Avoid claims such as “we never share data” if hosting providers, booking platforms or contractors handle it. Equally, a policy can’t authorise unrestricted future use simply by saying you may change it.
The 2026 change: information collected indirectly
The Privacy Amendment Act 2025 introduced IPP 3A, which took effect on 1 May 2026. As at October 2026, the requirement is in force.
It applies when personal information is collected from someone other than the individual concerned. For agencies, this can include identifiable lead details shared by a client or referral partner.
Unless an exception applies, take reasonable steps to notify the person as soon as reasonably practicable after collection. The OPC’s IPP 3A guidance explains what the notice must include and outlines the exceptions.
Notifications cover the collection, its purpose, intended recipients, relevant agencies and contact details, applicable legislation, and access or correction rights. The rule applies to indirect collections from its commencement date, not retrospectively.
Publishing a generic policy doesn’t automatically meet this obligation. Assign responsibility for notifications in your systems and automation workflows, and document any exception you rely on.
Forms, cookies and marketing need clear choices
Separate enquiries from promotional email
Place a short collection notice beside your form, with a link to the full policy. Explain what happens when someone submits their details. A footer link alone can be easy to miss.
Keep notices readable on mobile-responsive pages. Conversion optimisation should preserve meaningful choices rather than burying them beneath the submit button.
A quote request doesn’t automatically authorise ongoing email marketing. New Zealand’s Unsolicited Electronic Messages Act 2007 governs commercial electronic messages separately from the Privacy Act.
A separate, optional, unticked marketing consent box is a practical way to record permission where consent is appropriate. Keep evidence of consent, identify the sender and provide a working unsubscribe route. Apply the same review to promotional SMS and automated follow-up.
Explain cookies and tracking
Audit Google Analytics, Meta Pixel, embedded videos, booking widgets and anti-spam services. Establish what each collects, where information goes and whether providers use it for their own purposes.
Describe relevant cookies and tracking in plain language. Whether you need a consent banner depends on the tools you use, the information they collect and your audience.
Social media lead forms also need attention when they feed your database. For digital marketing measurement, avoid sending names, email addresses or sensitive form content into analytics events.
If you target people overseas, check additional laws, including applicable UK cookie rules. Your New Zealand settings may not be suitable for every audience.
Storage, security and overseas providers
Protect information throughout its journey
The Privacy Act requires reasonable security safeguards. Consider HTTPS, multi-factor authentication, restricted staff access and timely software updates.
Protect stored enquiries and backups as well as the website itself. Remove former staff accounts, control exports and avoid forwarding sensitive uploads to widely shared inboxes.
Your website care and maintenance arrangements should identify who handles updates, monitoring and recovery. Ask separately who can access customer information.
Keep information only as long as needed for lawful purposes. Set retention rules for submissions, customer records and backups, with appropriate deletion processes. Don’t promise immediate deletion if your systems or legal obligations prevent it.
Check overseas handling before making promises
Under IPP 12’s overseas disclosure rules, disclosure to a foreign person or entity generally needs an applicable basis, such as comparable privacy safeguards or contractual protections.
Overseas cloud storage isn’t automatically an IPP 12 disclosure. A provider acting solely as your storage or processing agent may fall outside that rule, but you remain responsible for the information.
If a provider uses information independently, the analysis may change. Check contracts, subprocessors, locations and support access.
For AI tools used by small businesses, review prompt retention, training use and third-party access before entering identifiable client information.
Access requests and privacy breaches
Handle access and correction requests promptly
People can generally request their personal information and ask you to correct it. Verify their identity proportionately, then search relevant systems, including email, forms and connected platforms.
You generally have 20 working days to decide an access or correction request. Provide approved access without undue delay, and explain any lawful extension or refusal.
If you decline a correction request, explain your decision. Follow the requirements for attaching a requested statement of correction. Don’t promise a general right to erase everything, as New Zealand’s access and correction rights differ.
People should first raise concerns with your business. Unresolved issues can go through the Privacy Commissioner’s complaint process, which is free.
Prepare a breach response before an incident
A privacy breach can include an exposed database, a compromised account or an attachment emailed to the wrong recipient.
Contain the incident, preserve evidence and assess the likely harm. Under the OPC’s privacy breach guidance, breaches that cause or are likely to cause serious harm must be reported to the Commissioner and affected people, unless an exception applies.
The law requires notification as soon as practicable. The OPC expects notification to its office within 72 hours of becoming aware of a notifiable breach, but this isn’t a fixed statutory deadline.
Assign responsibility for assessing and reporting breaches, and communicating with customers, before anything goes wrong.
Build privacy into website delivery
Include privacy requirements in web design and development briefs before choosing integrations. Test a real submission through the website, inbox and lead generation system to identify every destination.
Clear branding and polished pages can’t compensate for undisclosed data flows. Whether visitors arrive through local SEO or your Google Business Profile, collection notices should be easy to find.
Creative agencies should agree who approves notices, manages access requests and checks suppliers. See how we collaborate with creative agencies when technical delivery and ongoing support need defined ownership.
Review the policy whenever you add a platform, change retention or introduce new tracking. Record its review date and confirm that actual settings still match the text.
Frequently asked questions
Can schools install CCTV in bathroom areas?
This needs a case-specific assessment. The OPC’s school bathroom CCTV guidance recommends careful consideration, a privacy impact assessment and safeguards against recording toileting or changing.
Schools need a lawful purpose, proportionate collection and clear information about surveillance. Notices should explain relevant access and handling practices.
Audio is more intrusive. Switch it off when unnecessary; if it’s justified, assess it separately and tell people. These are surveillance obligations, not ordinary website requirements, and a published policy doesn’t make intrusive recording acceptable.
Can New Zealand Customs demand a device password?
Customs’ electronic-device examination rules require reasonable cause to suspect relevant offending for an initial search. A full search requires reasonable cause to believe evidential material is on the device.
Officers can require access information. Refusal without reasonable excuse can lead to a fine of up to NZ$5,000 on conviction, with possible device seizure.
Before business travel, minimise locally stored client data and follow your organisation’s security policy. These border powers are separate from website privacy notices.
Make the policy match the website
A useful New Zealand privacy policy follows the information your business actually handles. Clear ownership matters just as much as clear wording.
Map collection and connected services, then align notices, permissions, retention and response procedures. Review indirect collection against the rules effective since 1 May 2026.
Your website’s privacy promises should remain accurate after the form is submitted.
