Privacy Act 2020 (2020 No 31), as amended by the Privacy Amendment Act 2025 · Algorithm Charter for Aotearoa New Zealand (2020, voluntary — binds signatory public agencies only) · Information Privacy Principles 1–13 and IPP 3A — Status: No AI-specific law — the Privacy Act 2020 binds
New Zealand has no AI statute and has said it does not intend to pass one: its 2025 national AI strategy relies on existing law and sector regulators. The binding instrument for AI is the Privacy Act 2020, which took effect on 1 December 2020 and applies to any agency handling personal information, including one used to train or run a model. Its thirteen Information Privacy Principles cover purpose-limited collection, collection from the individual concerned, notification, accuracy, retention, security, access and correction, use and disclosure limits, unique identifiers, and cross-border disclosure — and the Privacy Amendment Act 2025 added IPP 3A, in force 1 May 2026, which requires an agency that collects personal information INDIRECTLY (that is, from anyone other than the individual) to notify that individual. That obligation lands squarely on AI systems trained or enriched on data sourced from third parties. Alongside it, the Algorithm Charter for Aotearoa New Zealand commits signatory PUBLIC agencies to transparency about how algorithms inform decisions, human oversight and review of unintended bias; it is a voluntary commitment by government agencies and imposes nothing on private businesses.