What the Privacy Act 2020 Actually Covers

The Privacy Act 2020 applies to almost every New Zealand organisation that collects, holds, uses or shares personal information, regardless of size. There is no small business exemption. If your website captures a name, an email address, a phone number or even an IP address through analytics, you are handling personal information under the Act.

The Act is built around 13 Information Privacy Principles. For a website owner, the ones that matter most are straightforward: only collect what you need, tell people why you are collecting it, keep it reasonably secure, and let people see or correct what you hold on them. You do not need to memorise all 13, but your privacy policy and your actual practice need to line up with them.

The Five Places Your Website Collects Personal Information

Most small business owners underestimate how many places on their own site are quietly gathering data. Before you write or update a privacy policy, audit these:

• Contact and quote forms. Name, email, phone number and whatever detail someone types into the message box.
• Newsletter and sign-up forms. Email addresses stored in an email marketing platform, often for years.
• Live chat and chatbot widgets. Conversation history, and sometimes the visitor’s email if they leave one. If you run a live chat widget on your site, check what the vendor does with transcripts.
• Booking and appointment tools. Names, contact details, and sometimes payment information passed to a third-party booking platform.
• Analytics and ad pixels. Google Analytics, Meta Pixel and similar tools collect IP addresses, device identifiers and browsing behaviour, which count as personal information under the Act.

What a Compliant Privacy Policy Needs to Say

A privacy policy copied from an overseas template will not match what your New Zealand website actually does, and that mismatch is itself a problem. Your policy needs to describe your real practice, in plain language, covering:

1. What you collect. List the actual categories of information, from contact forms through to analytics data.
2. Why you collect it. Responding to enquiries, sending the newsletter someone signed up for, processing a booking.
3. How you store and protect it. Which systems hold the data and what security measures are in place.
4. Who you share it with. Email platforms, booking software, payment processors and any other third party that touches the data.
5. How people can access or correct their information. A named contact or email address people can use to ask what you hold on them.

Cookies, Analytics and Ad Pixels: The Part Most Policies Get Wrong

Most NZ privacy policies mention cookies in a single generic paragraph and leave it there. That is not enough once you are running Google Analytics, a Meta Pixel for retargeting, or any heatmap or session-recording tool. Each of these collects identifiers that count as personal information, and your policy should name the specific tools in use, not just the category.

If your site relies heavily on paid traffic and retargeting, cross-check your cookie disclosure against what your ad accounts are actually tracking. A business running Facebook and Instagram ads should be explicit in its policy that a pixel is firing and what it captures, in the same way a business that advertises should already be thinking about how its broader website legal requirements line up with what the site actually does.

If Something Goes Wrong: The 72-Hour Breach Rule

The Privacy Act 2020 introduced mandatory breach notification, and it catches small businesses more often than owners expect. A breach is notifiable when it has caused, or is likely to cause, serious harm, for example a leaked customer list, a hacked contact form database, or an email sent to the wrong group of subscribers.

• Assess the harm. Consider how sensitive the information is, who now has access to it, and whether it was protected (encrypted, password-protected) before deciding if the breach is notifiable.
• Report within 72 hours. If the breach is notifiable, report it to the Office of the Privacy Commissioner as soon as practicable, generally within 72 hours of becoming aware of it.
• Tell affected people. In most notifiable cases you also need to tell the individuals affected, not just the regulator.
• Keep a record either way. Even if you decide a breach is not notifiable, document the assessment and the steps you took.

Part of avoiding a breach in the first place is having a sound recovery position if your site is compromised. A documented website backup plan and a clear process for who owns your data are both worth having before you need them, not after.

A Privacy Checklist for Your Website

Run through this before you publish or update your privacy policy:

• Every form on your site is listed in your privacy policy, including quote and lead capture forms.
• Analytics and ad pixels are named, not just described as “cookies”.
• Third-party tools are disclosed, from your email platform to your booking system.
• A real contact method is provided for access and correction requests.
• A breach response process exists, even if it is two paragraphs in a shared document.
• The policy link sits somewhere a visitor will actually find it, not buried three clicks deep in the footer.

FAQ

Do all small business websites in New Zealand need a privacy policy?

There is no single law that forces every website to publish a privacy policy page, but if your site collects any personal information, through a contact form, analytics, or a newsletter sign-up, having one is the practical way to meet your obligations under the Privacy Act 2020.

Does the Privacy Act 2020 apply to a one-person business?

Yes. The Act applies to organisations of all sizes, including sole traders, as soon as they collect, hold or use personal information in the course of running the business.

What happens if I do not report a notifiable breach?

Failing to report a notifiable breach to the Office of the Privacy Commissioner can itself be treated as a breach of the Act, separate from the original incident, and can carry financial penalties.

Can I use a privacy policy template from an Australian or UK site?

Only as a starting structure. A template written for another country’s law will reference the wrong legislation and often the wrong rights, so it needs to be rewritten to match the Privacy Act 2020 and your actual practices.