NZ Privacy Commissioner's AI Rules: What You Must Do Now

New Zealand organisations deploying or using Artificial Intelligence (AI) tools that interact with personal information are now operating under clear, stringent expectations from the Office of the Privacy Commissioner (OPC). This guidance isn't just a suggestion; it's the OPC's roadmap for how to comply with the Privacy Act 2020 in the age of AI.

What's changing — substance

The OPC's guidance, effective September 21, 2023, clarifies how the 13 Information Privacy Principles (IPPs) of the Privacy Act 2020 apply across the entire AI lifecycle – from the initial collection of data for training to the final outputs and decisions made by AI systems. While the guidance itself isn't legally binding, it outlines the OPC's interpretation of existing law, meaning non-compliance with these expectations can lead to investigations and penalties under the Privacy Act.

At its core, the guidance demands a proactive, privacy-by-design approach to AI. Organisations must ensure senior leadership is actively involved, approving AI projects only after thorough, documented risk assessments. This isn't a task to delegate entirely to IT; it requires strategic oversight.

A critical requirement is the mandatory conduct of Privacy Impact Assessments (PIAs) and Algorithmic/AI Impact Assessments (AIAs) (as noted in the guidance's "Overview" section). These assessments are crucial for identifying and mitigating privacy risks before an AI system goes live. They should consider not just direct data handling but also potential biases, discriminatory outcomes, and the broader societal impacts of the AI.

Transparency is paramount. Individuals must be clearly informed when AI is being used, especially if it impacts decisions affecting them. The guidance expects human review for decisions made by AI that have significant consequences for individuals. This ensures accountability and provides a safeguard against automated errors or biases. Even seemingly innocuous or fabricated data, like deepfakes or fake profiles, can be considered "personal information" if an individual is identifiable, broadening the scope of what needs protection.

Furthermore, the OPC places a strong emphasis on engagement with Māori and other affected communities. This is vital for addressing unique cultural concerns, data sovereignty issues, and ensuring AI systems are developed and deployed in a culturally appropriate and equitable manner.

Finally, for organisations relying on third-party AI providers (e.g., using generative AI APIs), the guidance mandates robust contractual safeguards. These contracts must explicitly prevent providers from retaining, repurposing, or further processing personal information without a clear, lawful basis. This is a critical point for smaller organisations, which might be tempted to feed personal data into off-the-shelf AI tools without fully understanding the data handling implications.

Who is affected — jurisdictions, sectors, sizes

This guidance applies to any organisation in New Zealand that designs, deploys, or uses AI tools that handle personal information. This includes both public sector agencies and private businesses, regardless of their size or sector. If your AI system interacts with data that could identify an individual, you are in scope.

This broad reach means that a small startup using a third-party AI tool for customer service, a large corporation leveraging AI for data analytics, or a government agency deploying AI for public services – all must adhere to these expectations. Smaller organisations, in particular, need to be acutely aware of the risks associated with feeding personal or sensitive data into third-party AI tools, as they may lack the in-house expertise or resources to implement robust technical and contractual protections without careful planning.

Three things to do this week — concrete actions

To ensure your organisation is on the path to compliance, here are three immediate actions, drawn directly from the OPC's critical compliance items:

Conduct Privacy Impact Assessments (PIAs) and Algorithmic/AI Impact Assessments (AIAs) for all AI projects. This is not optional. The guidance explicitly states this under its "Overview" section. For any AI system that processes personal information, you must systematically identify, assess, and mitigate privacy risks. This involves understanding the data inputs, how the AI processes them, its outputs, and the potential impact on individuals. If you haven't started, initiate this process for existing and planned AI deployments immediately.
Ensure all personal information used by AI is collected and used lawfully. This fundamental requirement is highlighted in the "Key Focus Areas" of the guidance. Review your data collection practices for AI training and operation. Do you have a lawful basis (e.g., consent, legitimate purpose) for collecting and using this personal information? Is it collected directly from the individual where possible? Is it accurate, up-to-date, and not held for longer than necessary? Any data feeding into your AI must meet the standards of the Privacy Act 2020 from the outset.
Establish a clear process for notifying the Privacy Commissioner of all notifiable privacy breaches. The guidance, under "Penalties, Liability, and Appeals," reinforces the existing obligation to report serious privacy breaches. Given the complexities of AI systems, the potential for large-scale breaches is significant. Your organisation must have a robust incident response plan that specifically addresses AI-related privacy breaches, including how to detect them, assess their severity, and promptly notify the OPC and affected individuals when required. Failure to notify can incur criminal sanctions.

Related context

The OPC's guidance on AI is part of a broader regulatory landscape evolving in New Zealand. Organisations should also be aware of the following related initiatives and guidance:

New Zealand AI Regulation Overview (/regulations/RAI-NZ-NA-SUMMARY-2026)
Responsible Artificial Intelligence guidance for businesses (/regulations/RAI-NZ-NA-RAIGBXX-2025)
Responsible AI Guidance for the Public Service: GenAI (/regulations/RAI-NZ-NA-RAGPSXX-2025)

These complementary resources provide further context and specific advice for different sectors, helping to paint a comprehensive picture of New Zealand's approach to responsible AI development and deployment.

Note: this article was drafted by AI - Google Gemini