New Zealand

New Zealand - Regulatory Gap as EU AI Act Takes Effect

New Zealand faces a growing regulatory gap as European AI rules (EU AI Act) begin phasing in and reshape global standards. NZ currently relies on a patchwork of existing laws (Privacy Act, Algorithm Charter, Consumer Guarantees Act) with no dedicated AI legislation.

New Zealand - Businesses Urged to Lead on AI Regulation

Industry leaders argue that businesses should take the lead in developing AI regulation in New Zealand, as industry-driven standards can be more practical and timely than government-led rules.

Jones v. Family Court at Whangarei

Pro Se Litigant appeared before the Supreme Court. Fabricated: Case Law | "Awatere Huata v Prebble [2002] 3 NZLR 827" — example of a real case name paired with an incorrect citation; Court found it to be a hallucinated/erroneous citation. Outcome: Warning.

Jones v. Family Court at Whangarei

Fabricated: Case Law | "Awatere Huata v Prebble [2002] 3 NZLR 827" — example of a real case name paired with an incorrect citation; Court found it to be a hallucinated/erroneous citation. || Misrepresented: Case Law | "Baird v R [2013] NZSC 120" — cited in submissions with an incorrect citation; Court identified this as an example of AI-produced incorrect authority. || Misrepresented: Case Law | "Teddy v Police [2015] NZSC 62" — real case name combined with an incorrect citation; Court treated it as an AI-generated hallucinated authority and noted the genuine case/citation combination was not directly relevant.

Jones v. Family Court at Whangarei

Privacy Commissioner's investigation into Manage My Health over alleged cybersecurity breach

On 21 January 2026, the Office of the Privacy Commissioner announced an investigation into Manage My Health over a cybersecurity breach in the digital health sector that handles sensitive patient information. The investigation seeks to examine the causes and scale of the breach, the adequacy of security safeguards, affected patient data, governance and contractual arrangements across the health system, and compliance with the Privacy Act and the Health Information Privacy Code 2020. It was st...

Coulson v. ASB Bank

Pro Se Litigant appeared before the High Court. False Quotes: Legal Norm

Coulson v. ASB Bank

False Quotes: Legal Norm

Coulson v. ASB Bank

Privacy Commissioner guidance on use of images under Privacy Act

On 11 August 2025, the Privacy Commissioner issued guidance on the use of images under the Privacy Act 2020. The Commissioner confirmed that photographs qualify as personal information when they identify an individual. Agencies are expected to be transparent when collecting, using, or sharing such information, and commercial agencies must do so fairly and without unreasonable intrusiveness, even in public places. The guidance also stressed that the fact that personal information is publicly a...

QTR v BXD ([2025] NZERA 716)

Pro Se Litigant used ChatGPT in proceedings before the Employment Relations Authority. Fabricated: Case Law | Lengthy document submitted by QTR contained numerous non-existent case citations described by the Authority as 'hallucinated' legal cases asserted as authority.

QTR v BXD ([2025] NZERA 716)

Fabricated: Case Law | Lengthy document submitted by QTR contained numerous non-existent case citations described by the Authority as 'hallucinated' legal cases asserted as authority. || Misrepresented: Case Law | Document included incorrectly cited cases and mis-citations (real cases cited incorrectly), which the Authority identified as part of the AI-generated errors.

QTR v BXD ([2025] NZERA 716)

National Cyber Security Centre cyber security alert regarding exploitation of vulnerabilities in Fortinet FortiOS products

On 11 April 2025, the National Cyber Security Centre (NCSC) issued a cyber security warning regarding the exploitation of vulnerabilities in Fortinet FortiOS products. In particular, CVE-2022-42475, CVE-2023-27997 and CVE-2024-21762 have been actively targeted by threat actors since 2023, allowing them to compromise devices, maintain persistence and potentially access sensitive data such as credentials and key material. Organisations with exposed SSL-VPN functionality during this period are u...

Deepfake Digital Harm and Exploitation Bill

On 23 October 2025, the Deepfake Digital Harm and Exploitation Bill was introduced in New Zealand Parliament. The Bill aims to amend the Crimes Act 1961 and the Harmful Digital Communications Act 2015 by including digitally altered or synthesised images within the definition of an intimate visual recording. This Bill intends to address the proliferation of sexually explicit deepfakes and extend legal protections to individuals whose likeness is used without consent. The Bill specifies that in...

Office of the Privacy Commissioner clarification on information sharing for child safety and wellbeing

On 9 October 2025, the Office of the Privacy Commissioner (OPC) of New Zealand issued a public statement clarifying that the Privacy Act 2020 does not prevent the sharing of information where there is a safety or well-being concern for a child. The statement followed the Government’s acceptance of all recommendations from the 2022 Dame Karen Poutasi Review on changes to improve the system of safety nets for preventing harm in the children's system. It stated that the Oranga Tamariki Act allow...

Department of Internal Affairs inquiry into terrorist and violent extremist content

On 9 July 2025, New Zealand's Department of Internal Affairs (DIA) adopted the 2024 digital violent extremism transparency report, highlighting a 10% increase in referrals of extremist online content, with 974 URLs flagged over the year. The report applies to digital platforms hosting user-generated content and revealed that 243 informal and 38 formal take-down notices were issued, resulting in the removal of 88% of flagged content. The most commonly reported ideology was identity-motivated e...

Cunningham v healthAlliance NZ Limited

Pro Se Litigant appeared before the Employment Court. Fabricated: Case Law | Mr Cunningham cited this authority to support a procedural fairness argument; the Court found the case does not exist and noted it may have been generated by AI. Outcome: Warning.

Cunningham v healthAlliance NZ Limited

Fabricated: Case Law | Mr Cunningham cited this authority to support a procedural fairness argument; the Court found the case does not exist and noted it may have been generated by AI. || Fabricated: Case Law | Mr Cunningham cited this authority in support of seeking a stay; the Court found the case does not exist and noted it may have been generated by AI.

Cunningham v healthAlliance NZ Limited

Ministry of Business, Innovation and Employment's Artificial Intelligence strategy

On 8 July 2025, the Ministry of Business, Innovation and Employment adopted the Artificial Intelligence (AI) strategy focusing on investing with confidence to drive AI adoption and economic growth. The strategy aims to boost productivity in key sectors including agriculture, healthcare, education, and tourism. The strategy applies to both public and private sectors, addressing the low uptake among small and medium enterprises and principles-based policy aligned with Organisation for Economic ...

Responsible AI Guidance for Businesses: Investing with Confidence

New Zealand's Ministry of Business, Innovation and Employment (MBIE) published this guidance to accelerate private sector AI adoption while promoting responsible use. It provides a framework for businesses to assess AI risks, establish internal governance, ensure transparency with customers, and comply with existing legal obligations. The document outlines practical steps for due diligence when procuring or developing AI systems, and includes checklists and resources to help organisations ethically source datasets and manage AI-related risks.

Guidance on indirect collection of personal information in Privacy Amendment Bill (No. 292-1)

On 25 June 2025, the Privacy Commissioner closes its consultation on draft guidance on the Privacy Amendment Bill, focusing on the new Information Privacy Principle (IPP) 3A, which introduces notification requirements for the indirect collection of personal information. The draft guidance outlines how organisations should notify individuals when collecting their personal data from third-party sources. It also clarifies the circumstances under which such notification may be waived, the types o...

Department of Internal Affairs investigation into distribution of child sexual exploitation material online

On 30 April 2025, the New Zealand Department of Internal Affairs published the 2024 Digital Child Exploitation Transparency Report, following an investigation into child sexual exploitation material shared via online platforms. In 2024, the Department blocked more than 1'032'683 attempts to access websites containing objectionable content using the Digital Child Exploitation Filtering System. In collaboration with the National Center for Missing and Exploited Children, the Department received...

National Cyber Security Centre Minimum Cyber Security Standards

On 4 July 2025, the National Cyber Security Centre closes its consultation on the Minimum Cyber Security Standards. The consultation, conducted in collaboration with the Public Service Commission (PSR), seeks feedback from mandated agencies and industry partners regarding the proposed standards. These standards establish minimum cybersecurity practices, require agencies to meet Capability Maturity Model level two (CMM2) for business-critical and external-facing systems, and were published on ...

Customer and Product Data Bill

On 29 March 2025, the Customer and Product Data Bill enters into force. The purpose of the Bill is to establish a consumer data rights framework with a view to facilitating access to and sharing of customer and product data across the economy. The Bill stipulates that designated data holders, such as businesses holding customer data, must provide such data to customers and, with the customers' authorisation, to accredited third parties. The Bill stipulates that data holders must respond to el...

LMN v. STC (No. 2)

Pro Se Litigant appeared before the . Fabricated: Case Law | Plaintiff cited a non-existent case to argue the Court considers financial constraints; the Court stated no such case exists and warned about relying on generative AI outputs. Outcome: Warning.

Biometrics Code of Practice

On 3 November 2025, the Privacy Commissioner Biometric Processing Privacy Code 2025, issued under the Privacy Act 2020, enters into force. The Code strengthens existing notification, purpose, and transparency obligations and introduces a requirement for agencies to conduct a proportionality assessment weighing the privacy risks and public benefits of biometric processing, as well as to implement appropriate privacy safeguards. It applies to all biometric identification, verification, and cate...

Wikeley v Kea Investments Ltd

Pro Se Litigant used Unidentified in proceedings before the . Fabricated: Case Law | Mr Wikeley filed and then withdrew a 10 September 2024 memorandum that cited apparently non-existent cases, attributed by the Court to undisclosed use of generative AI. Outcome: Referred to guidance about AI.

NZSIS and NCSC guidance on secure innovation: security advice for emerging technology companies

On 29 October 2024, the New Zealand Security Intelligence Service (NZSIS) and the Government Communications Security Bureau’s (GCSB) National Cyber Security Centre (NCSC) released the guidance Secure Innovation: Security Advice for Emerging Technology Companies. The guidance provides information to New Zealand’s emerging technology sector, particularly tech start-ups, to defend against potential espionage and intellectual property theft. The guidance, developed with counterparts from Australi...

Declaration on joining Bletchley Declaration on AI Safety

On 23 October 2024, the New Zealand government adopted the Bletchley Declaration on Artificial Intelligence (AI) safety, which was already signed by 28 other countries. The Bletchley Declaration is an agreement on international cooperation to address AI risks arising from potential intentional misuse or unintended issues of control of frontier AI, focusing on cybersecurity, biotechnology and disinformation risks. In addition, the parties will collaborate to identify AI safety risks and build ...

Office of the Privacy Commissioner's guide for organisations on handling privacy complaints

On 16 October 2023, the Office of the Privacy Commissioner issued a guide on handling privacy complaints. The guide outlines a five-step process for organisations, specifically acknowledging the complaint, listening to the complainant, investigating the issues, attempting to resolve the problem collaboratively, and rebuilding trust afterwards. The guide aims to help organisations manage privacy concerns effectively and maintain positive relationships with individuals.

OPC Guideline on section 77 of the Privacy Act 2020 on conciliation

On 16 October 2024, the Office of the Privacy Commissioner (OPC) issued guidelines on the use of conciliation under section 77 of the Privacy Act 2020 to resolve privacy complaints. The guideline applies to organisations that may have breached privacy principles, aiming to facilitate early resolution through conciliation meetings rather than formal investigations. It allows parties to negotiate a mutually agreeable outcome, with the OPC providing guidance, though the final decision rests with...

Budapest Convention and Related Matters Legislation Amendment Bill

On 22 September 2024, the Budapest Convention and Related Matters Legislation Amendment Bill was introduced in the parliament. The Bill aligns with the Budapest Convention and includes provisions such as new "preservation directions" in the Search and Surveillance Act for securing digital evidence, amendments to the Mutual Assistance in Criminal Matters Act to enhance international cooperation, and updates to the Crimes Act to ensure cybercrime offences fully meet the Convention's requirements.

National Cyber Security Centre Rolls and Responders Incident Response Testing Resource

On 9 October 2024, the National Cyber Security Centre (NCSC) launched "Rolls & Responders," a new tool designed to help organisations improve their cyber resilience. This resource provides a practical and engaging way for businesses to test their incident response plans, ensuring they are better prepared to handle potential cyber incidents. By offering an easy-to-use, simulation-based approach, the tool aims to simplify the testing process, making it more accessible and less time-consuming fo...

Privacy Commissioner Investigation into Foodstuffs North Island's Facial Recognition Technology Trial

On 8 February 2024, the Privacy Commissioner announced an investigation into the facial recognition technology (FRT) trial initiated by Foodstuffs North Island. The trial, which spans over 25 stores, was requested by the Commissioner to provide evidence that FRT is a justified method to reduce retail crime, considering the privacy implications of using shoppers' biometric information. The Commissioner expressed concerns about the effectiveness of FRT in reducing harmful behaviour in supermark...

MBIE Cabinet paper on approach to work on Artificial Intelligence

On 25 July 2024, the Ministry of Business, Innovation and Employment adopted a paper on the approach to work on Artificial Intelligence (AI). The paper applies to both the public sector and the broader economy, focusing on the increasing use of AI across various sectors in New Zealand. The paper highlights that New Zealand faces several challenges in securing the potential of AI, including a general mistrust of AI, low uptake in the economy, and limited adoption in public services, hindering ...

Office of the Privacy Commissioner's guidance on good privacy practices

On 22 June 2024, the New Zealand Office of the Privacy Commissioner (OPC) closes the public consultation on the draft guidance on good privacy practices. The guideline is addressed to businesses and serves as a recommendation on how to implement privacy obligations into business practices. The guidance specifically aims to assist businesses in developing and implementing precautionary and preliminary measures in relation to privacy. In particular, the guidance addresses the topics of governan...

Safer Online Services and Media Platforms Review

On 29 April 2024, the Department of Internal Affairs (DIA) released a summary report concluding the Safer Online Services and Media Platforms review, formerly known as the Content Regulatory Review. The report release represents the closure of the inquiry. The review aimed to regulate online services and media platforms in New Zealand, focusing on reducing harmful online content while balancing freedom of expression and press freedom. The summary document highlights public feedback on the pro...