New Zealand

Government Moves Ban U16S Social Media

Privacy Commissioner's investigation into Manage My Health over alleged cybersecurity breach

On 21 January 2026, the Office of the Privacy Commissioner announced an investigation into Manage My Health over a cybersecurity breach in the digital health sector that handles sensitive patient information. The investigation seeks to examine the causes and scale of the breach, the adequacy of security safeguards, affected patient data, governance and contractual arrangements across the health system, and compliance with the Privacy Act and the Health Information Privacy Code 2020. It was st...

Privacy Commissioner guidance on use of images under Privacy Act

On 11 August 2025, the Privacy Commissioner issued guidance on the use of images under the Privacy Act 2020. The Commissioner confirmed that photographs qualify as personal information when they identify an individual. Agencies are expected to be transparent when collecting, using, or sharing such information, and commercial agencies must do so fairly and without unreasonable intrusiveness, even in public places. The guidance also stressed that the fact that personal information is publicly a...

Office of the Privacy Commissioner clarification on information sharing for child safety and wellbeing

On 9 October 2025, the Office of the Privacy Commissioner (OPC) of New Zealand issued a public statement clarifying that the Privacy Act 2020 does not prevent the sharing of information where there is a safety or well-being concern for a child. The statement followed the Government’s acceptance of all recommendations from the 2022 Dame Karen Poutasi Review on changes to improve the system of safety nets for preventing harm in the children's system. It stated that the Oranga Tamariki Act allow...

Ministry of Business, Innovation and Employment's Artificial Intelligence strategy

On 8 July 2025, the Ministry of Business, Innovation and Employment adopted the Artificial Intelligence (AI) strategy focusing on investing with confidence to drive AI adoption and economic growth. The strategy aims to boost productivity in key sectors including agriculture, healthcare, education, and tourism. The strategy applies to both public and private sectors, addressing the low uptake among small and medium enterprises and principles-based policy aligned with Organisation for Economic ...

Responsible AI Guidance for Businesses: Investing with Confidence

New Zealand's Ministry of Business, Innovation and Employment (MBIE) published this guidance to accelerate private sector AI adoption while promoting responsible use. It provides a framework for businesses to assess AI risks, establish internal governance, ensure transparency with customers, and comply with existing legal obligations. The document outlines practical steps for due diligence when procuring or developing AI systems, and includes checklists and resources to help organisations ethically source datasets and manage AI-related risks.

Department of Internal Affairs inquiry into terrorist and violent extremist content

On 9 July 2025, New Zealand's Department of Internal Affairs (DIA) adopted the 2024 digital violent extremism transparency report, highlighting a 10% increase in referrals of extremist online content, with 974 URLs flagged over the year. The report applies to digital platforms hosting user-generated content and revealed that 243 informal and 38 formal take-down notices were issued, resulting in the removal of 88% of flagged content. The most commonly reported ideology was identity-motivated e...

Artificial Intelligence Strategy And Business Guidance Now Available

Department of Internal Affairs investigation into distribution of child sexual exploitation material online

On 30 April 2025, the New Zealand Department of Internal Affairs published the 2024 Digital Child Exploitation Transparency Report, following an investigation into child sexual exploitation material shared via online platforms. In 2024, the Department blocked more than 1'032'683 attempts to access websites containing objectionable content using the Digital Child Exploitation Filtering System. In collaboration with the National Center for Missing and Exploited Children, the Department received...

Manage risk and maximise opportunity with first of its kind AI system management standard ISO/IEC 42001

Declaration on joining Bletchley Declaration on AI Safety

On 23 October 2024, the New Zealand government adopted the Bletchley Declaration on Artificial Intelligence (AI) safety, which was already signed by 28 other countries. The Bletchley Declaration is an agreement on international cooperation to address AI risks arising from potential intentional misuse or unintended issues of control of frontier AI, focusing on cybersecurity, biotechnology and disinformation risks. In addition, the parties will collaborate to identify AI safety risks and build ...

MBIE Cabinet paper on approach to work on Artificial Intelligence

On 25 July 2024, the Ministry of Business, Innovation and Employment adopted a paper on the approach to work on Artificial Intelligence (AI). The paper applies to both the public sector and the broader economy, focusing on the increasing use of AI across various sectors in New Zealand. The paper highlights that New Zealand faces several challenges in securing the potential of AI, including a general mistrust of AI, low uptake in the economy, and limited adoption in public services, hindering ...

Safer Online Services and Media Platforms Review

On 29 April 2024, the Department of Internal Affairs (DIA) released a summary report concluding the Safer Online Services and Media Platforms review, formerly known as the Content Regulatory Review. The report release represents the closure of the inquiry. The review aimed to regulate online services and media platforms in New Zealand, focusing on reducing harmful online content while balancing freedom of expression and press freedom. The summary document highlights public feedback on the pro...

DIA investigation into terrorist and violent extremist content online

On 26 March 2024, the Department of Internal Affairs (DIA) released its 2023 Digital Violent Extremism Transparency Report. The report provides insights into how DIA identifies and addresses online violent extremism. Key findings include a 25% increase in URL referrals from 2022 to 2023, with 38% of the 886 URLs reviewed deemed objectionable. Platforms such as X/Twitter, Telegram, and TikTok were the most commonly referred. Notably, TikTok removed 81% of reported content before formal request...

Reserve Bank of New Zealand Cyber Resilience Reporting Requirements

On 4 March 2024, the Reserve Bank of New Zealand made changes to cyber resilience reporting requirements following a public consultation. Entities, such as registered banks, deposit takers, and insurers, are required to report significant cyber incidents to the Reserve Bank as soon as practicable but within 72 hours. Entities are also required to report all cyber incidents to the Reserve Bank, regardless of materiality, with large entities required to report all cyber incidents every six mont...

DCET investigations into illegal CSAM material available online

On 20 February 2024, the Department of Internal Affairs of New Zealand (DIA) published the findings following the Digital Child Exploitation Team (DCET) investigations into illegal material available online, including child sexual abuse material (CSAM). The DIA stated that from January to December 2023, the DCET conducted 47 investigations, which resulted in the discovery of 2’966’773 pieces of illegal material and the seizure of 209 devices. Further, the investigation resulted in the blocki...

FMI Cyber Resilience Standard 17C

On 1 March 2024, the Financial Markets Authority (FMA) adopted the FMI STANDARD 17C, a Cyber Resilience Standard for Financial Market Infrastructures (FMIs). The standard mandates every operator of a designated FMI, as specified under section 29(2)(f) of the Financial Market Infrastructures Act 2021, to ensure the maintenance of cyber resilience in alignment with the FMI’s exposure to cyber risk. It encompasses operators within various classes of designated FMIs, including pure payment system...

Department of Internal Affairs' Take-down Notice Guidance

On 21 December 2023, the Department of Internal Affairs in New Zealand issued a Take-down Notice Guidance as part of the updates to the Films, Videos, and Publications Classification Act 1993. The guidance enables the Department to issue take-down notices to online content hosts, such as messaging services, online advertising providers, and platform intermediaries for e-commerce and user-generated content, requiring them to remove or prevent public access to content classified as objectionabl...

Artificial Intelligence and the Information Privacy Principles

Requires agencies using AI tools in New Zealand to conduct privacy impact assessments, ensure transparency, engage with Māori communities, and implement human review of AI outputs. Emphasizes compliance with the Privacy Act 2020 and its Information Privacy Principles.

Online News Act

On 17 August 2023, the Fair Digital News Bargaining Bill, aimed at regulating content remuneration between news publishers and digital platforms, was introduced to the New Zealand Parliament. The Bill aims to ensure that news publishers are fairly compensated for the use of their content by digital platforms, including online advertising providers, search service providers, and various platform intermediaries. The Bill establishes a framework for negotiations, a bargaining code, and a process...

National Security Group inquiry into critical infrastructure resilience

On 8 August 2023, the National Security Group (NSG) Part of the National Security and Intelligence Oversight closes the public consultation on the resilience of New Zealand’s critical infrastructure. The NSG issued a discussion document outlining a proposal for a systems-based regulatory approach to complement existing sectoral regulations with comprehensive resilience requirements for critical infrastructure. The document notes that telecommunications, financial, and digital services (such a...

Initial advice on Generative Artificial Intelligence in the public service (New Zealand)

Advises New Zealand Public Service on cautious use of GenAI, emphasizing data privacy, security, and ethical considerations. Prohibits using GenAI with sensitive or personal data externally. Stresses governance, transparency, and collaboration, especially concerning Māori data and interests.

Consultation on privacy regulation of biometric technologies in New Zealand

On 30 September 2022, the consultation by the Office of the Privacy Commissioner on privacy regulation of biometrics in New Zealand closed. The consultation paper invited views on the uses, concerns and risks involved in the use of biometrics, relevant Māori cultural perspectives on identity and privacy, application of the Privacy Act to biometrics, and other aspects of regulatory measures on the collection, storage, use and disclosure of biometric information.

Report on the Mapping Media Content Harms

On 22 September 2022, the Department of International Affairs of New Zealand published a Report on Mapping Media Content Harms. The report includes a conceptual framework designed to guide the Department of International Affairs in understanding the regulatory landscape of media content in New Zealand. It outlines the current regulatory scenario for content harms and delves into the content harms identified through literature research. The report introduces a conceptual framework that discuss...

Classification of "The Three Faced Terrorist -- Part Two" by Classification Office

On 26 July 2022, New Zealand's Classification Office concluded its investigation into part two of “The Three-Faced Terrorist” and classified it as objectionable. This decision follows the interim ban placed on the "pseudo-documentary" in June, which contains extensive footage from the 15 March Mosque attacks, accompanied by claims of fabrication. The final ruling deems the video as containing extreme cruelty and violence, degrading, dehumanising, and demeaning towards the victims of the terro...

Updated Digital Child Exploitation Filtering System Code of Practice

On 1 June 2022, New Zealand's Department of Internal Affairs adopted the Digital Child Exploitation Filtering System (DCEFS) Code of Practice addressed to Internet Service Providers (ISPs). The initiative is designed to prevent access to websites containing child sexual abuse material, thereby reducing the market for such material and contributing to a safer online environment. Participation by ISPs is voluntary, as New Zealand law does not mandate connection to the system. The DCEFS operates...

Classification Office assessment of "Buffalo mass shooting livestream" qualification as objectionable

On 16 May 2022, the Classification Office announced the temporary ban of the livestream video of the Buffalo mass shooting, following the decision to temporarily ban the shooter's manifesto. The video, which is 6 minutes and 52 seconds long, was classified as objectionable under the Films, Videos, and Publications Classification Act 1993, due to its depiction of extreme violence and cruelty. This classification makes it an offence to possess or distribute the video. A final classification dec...

Harmful Digital Communications (Unauthorised Posting of Intimate Visual Recording) Amendment Act 2022

On 9 March 2022, the Harmful Digital Communications (Unauthorised Posting of Intimate Visual Recording) Amendment Act 2022 entered into force. The Act amends the Harmful Digital Communications Act 2015 to introduce regulations against the unauthorised posting of intimate visual recordings. It establishes offences for posting such content without consent, with penalties including imprisonment and fines. Additionally, the amendment allows courts to make civil orders during proceedings, includin...

Data transfer measures in UK-New Zealand Free Trade Agreement

The UK-New Zealand Free Trade Agreement is signed. The Agreement includes measures concerning data transfers between the two countries. It enables the free flow of data between the UK and New Zealand by removing data localisation requirements and acknowledging that the UK and New Zealand have an equally strong data protection regime. Transfers of personal data between the UK to New Zealand are allowed as long as the countries satisfy the equivalent data protection. Moreover, the Agreement req...

Internal Department guideline on prohibition on remote interactive gambling

On 1 November 2021, the Internal Department of New Zealand adopted an outline specifying the regulation under the Gambling Act 2003, section 9(2)(b), which prohibits remote interactive gambling. This includes gambling through communication devices such as computers, telephones, and similar devices, where there is a payment to participate and an element of chance to win money or a prize. Exemptions include sales promotions in the form of a lottery conducted in New Zealand, activities by the Ne...

Guidance on cyber resilience for financial advice providers

On 29 July 2021, New Zealand's Financial Market Authority (FMA) adopted a guidance on cyber resilience for financial advice providers. The report indicates the specific obligations for financial advice providers to ensure that their systems remain secure. In addition, the report suggests equipping for cyber risk management, regularly testing systems and controls, cultivating a culture of awareness within the organisation, and notifying the FMA of any security breach.

Harmful Digital Communications (Appointment of Approved Agency) Order 2021 designating NetSafe Incorporated as approved agency

On 30 June 2021, the Harmful Digital Communications (Appointment of Approved Agency) Order 2021 entered into force. The order designates NetSafe Incorporated as the Approved Agency for a term of five years, in accordance with section 7 of the Harmful Digital Communications Act 2015. The appointment empowers NetSafe Incorporated to oversee the regulation of content moderation, aiming to address harmful digital communications across various sectors. This initiative is administered by the Minist...

Guidance for cyber resilience published by Reserve Bank

The Reserve Bank of New Zealand finalised its Guidance on Cyber Resilience, an outline of the Reserve Bank's expectations relating to cyber resilience for all entities under its regulatory domain. The outline includes what the RBNZ understands to be best practices in cyber resilience and suggests steps for the continued improvement of corporate policy and standards in this area.

Ministry of Health infection surveillance data standard

The Ministry of Health publishes the infection surveillance data standard, which defines the format and structure for capturing the information used to undertake surveillance of health care-associated infections, aiming to improve the quality of data for infection monitoring while ensuring that patients` privacy is protected.

Ministry of Health Cancer Multidisciplinary Meeting Data Standard

The Ministry of Health publishes the cancer multidisciplinary meeting data standard, which outlines the nationally agreed core data elements for capturing patient and cancer information to support the cancer multidisciplinary meeting process. The aim is to provide access to high-quality patient information while ensuring patients` privacy protection.

Cybersecurity regulation in Privacy Act (Bill No. 34-3/Act 2020 No. 31)

On 1 December 2020, the Privacy Act (2020 No. 31) entered into force. The Act includes provisions for cybersecurity regulation and mandates that agencies covered by the Bill must report data breaches. Specifically, the cybersecurity regulations, which are outlined in part 6 of the Act, delineate the procedures for handling notifiable privacy breaches and compliance notices. A notifiable privacy breach is a privacy breach that it is reasonable to believe has caused serious harm to an affected ...

Films, Videos, and Publications Classification (Commercial Video on-Demand) Amendment Act 2020

On 6 August 2020, the Films, Videos, and Publications Classification (Commercial Video on-Demand) Amendment Act 2020 was enacted after receiving royal assent. The amendment modified the Films, Videos, and Publications Classification Act 1993. In particular, the amendment broadened the Act's scope to encompass the classification of Commercial Video on-Demand (CVoD) content. CVoD content refers to visual media accessible online on-demand by users who have paid a fee. The primary goal of the Act...

Data protection authority governance in Privacy Act (Bill No. 34-3/Act 2020 No. 31)

On 1 December 2020, the Privacy Act (Act No. 31) entered into force. The Act established the responsibilities of the enforcement authority, the Office of the Privacy Commissioner. The Commissioner can request agencies to provide contact details, investigate complaints, name breaching agencies, issue compliance notices, or seek injunctions to prevent misuse of breached personal information. Additionally, the Commissioner has the power to adopt codes of practice for specific industries or sec...

Cross-border data transfer in Privacy Act (Bill No. 34-3/Act 2020 No. 31)

On 1 December 2020, the Privacy Act 2020 (Act No. 31), including cross-border data transfer regulation, entered into force. Agencies can transfer personal information overseas if the recipient is subject to privacy laws or contractual obligations providing safeguards comparable to the New Zealand Privacy Act. If such protections are not in place, the individuals have to provide informed consent for their data to be transferred. The Privacy Commissioner can prohibit transborder dataflows if th...

Public Service Generative AI Guidance