Most New Zealand small business websites are missing at least one thing the law actually requires. Not because owners are careless, but because the advice online is written for the United States or the United Kingdom, full of GDPR cookie banners and ADA lawsuits that do not apply here. The real list of website legal requirements for small business NZ owners need to meet is shorter, more specific, and tied to New Zealand law: the Privacy Act 2020, the Fair Trading Act 1986, and the Unsolicited Electronic Messages Act 2007. Here is what actually matters, and what you can safely ignore.

Why This Matters More Than It Looks Like It Does

A missing privacy policy or a vague terms page will not usually get a small business raided by a regulator. But it does create real exposure: a customer complaint to the Privacy Commissioner, a Fair Trading Act query from the Commerce Commission over a pricing claim, or simply losing a corporate client whose procurement team checks for a privacy policy before signing a contract. Getting the basics right is a small amount of work that closes off an entire category of risk.

Do You Need a Privacy Policy on Your Website?

If your site collects any personal information, through a contact form, a newsletter signup, an online booking system, or even Google Analytics, you are covered by the Privacy Act 2020 and should have a privacy policy. This applies to almost every business website in New Zealand, including one-page sites with a simple enquiry form.

A compliant privacy policy for a website NZ business runs should cover, in plain language:

• What you collect – names, emails, phone numbers, payment details, browsing data
• Why you collect it – responding to enquiries, processing orders, sending marketing
• How it is stored and secured – which systems hold the data and for how long
• Who it is shared with – email platforms, payment processors, hosting providers
• How customers can access or correct their information – a contact method, not just a form

Keep it specific to what your business actually does. A generic template copied from another country will often reference laws that do not apply here and can create confusion rather than protection.

Terms and Conditions: When You Need Them and When You Don’t

Terms and conditions are not a strict legal requirement for every website, but they become important the moment your site takes payments, bookings, or has any kind of ongoing service relationship. If customers can buy from you online, terms and conditions website NZ law expects you to have should cover:

1. Pricing and payment terms – GST-inclusive pricing, accepted payment methods, currency
2. Delivery or service timeframes – realistic estimates you can actually meet
3. Returns, refunds and cancellations – your policy alongside the rights customers already have under the Consumer Guarantees Act
4. Limitation of liability – reasonable limits on what your business is responsible for
5. Dispute resolution – how a disagreement gets resolved before it reaches a tribunal

A simple services business without online payments can usually get by with a shorter set of trading terms rather than a full e-commerce contract. Match the depth of the document to what the site actually does.

The Fair Trading Act: What You Say on Your Site Matters

The Fair Trading Act website compliance issue that catches out the most small businesses is not a missing document at all. It is language. The Act prohibits misleading or deceptive claims, and it applies fully to websites. Common problem areas include:

• “Sale” pricing that is not genuinely reduced from a normal selling price
• Before-and-after claims or results you cannot substantiate
• Delivery promises like “same day” or “next day” that are not consistently met
• Reviews or testimonials that are not genuine or are selectively edited
• Product descriptions that leave out a material limitation

Email and SMS Marketing: The Unsolicited Electronic Messages Act

If your website collects email addresses for a newsletter or promotions, the Unsolicited Electronic Messages Act NZ sets out three requirements for every marketing message you send:

• Consent – the person opted in, rather than being added automatically at checkout
• Accurate sender information – a real business name and a working reply address
• A functional unsubscribe option – one click, no login required, and it has to actually work

This is easy to build into a website signup form from the start. Retrofitting proper consent tracking into an existing list later is far more work, so get it right when the site is built.

Cookies and Third-Party Tools

New Zealand does not have a mandatory cookie-banner law the way the European Union does, so most local sites do not need an intrusive consent pop-up. What you do need is transparency: your privacy policy should plainly state that you use tools like Google Analytics, Meta Pixel, or live chat widgets, and explain in general terms what data they collect. If you are marketing into the EU or UK as well as NZ, different rules apply and a proper cookie consent tool becomes necessary.

A Practical Compliance Checklist

Before a new or redesigned site goes live, run through this list:

1. Privacy policy published and linked in the footer of every page
2. Terms and conditions in place if you take payments or bookings online
3. Pricing shown GST-inclusive, with any conditions clearly stated
4. Marketing claims checked against what you can actually prove
5. Newsletter signup captures clear consent and includes an unsubscribe link
6. Contact details are accurate and easy to find, not buried in a submenu
7. Policies reviewed whenever the business changes what data it collects or how it sells

This last point matters more than most business owners expect. A privacy policy written for the site launch can go stale within a year once you add a new booking tool, a loyalty programme, or a different payment provider. Treating these pages as a living part of your ongoing website maintenance rather than a one-off task keeps you compliant as the business evolves. If you are still working out which pages and features your site needs in the first place, our small business website checklist is a good starting point before you get to the legal layer.

Frequently Asked Questions

Do I need a lawyer to write my privacy policy?

Not necessarily. Many small businesses start with a well-adapted template that accurately reflects what the site actually does, then have a lawyer review it once the business handles more sensitive data or higher transaction volumes. What matters most is accuracy over polish.

Does a one-page website still need these documents?

If it has a contact form or any tracking script, yes to a privacy policy at minimum. Terms and conditions become necessary once you sell, book, or take deposits online.

What happens if I ignore this?

Consequences range from a complaint to the Privacy Commissioner or Commerce Commission, to reputational damage, to losing business clients whose own compliance checks require a visible privacy policy before they will sign a contract with you.

Who enforces these rules in New Zealand?

The Office of the Privacy Commissioner handles Privacy Act matters, the Commerce Commission enforces the Fair Trading Act, and the Department of Internal Affairs oversees the Unsolicited Electronic Messages Act.

Getting this right does not need to slow down a new site build. When we plan and build a website for a client, these pages are part of the standard scope, not an afterthought bolted on after launch.