Privacy, contact forms and newsletters for New Zealand websites

Short answer

Tell people what you collect and why, collect only what you need, keep it secure and know where it is stored. Since 1 May 2026, information privacy principle 3A also requires notice when you collect information about someone from a third party, with some exceptions. Marketing emails need consent and a working unsubscribe. This guide is general information, not legal advice.

The law in brief

The Privacy Act 2020 governs how organisations in New Zealand collect, store, use and share personal information. It is built around information privacy principles, or IPPs: thirteen numbered principles plus IPP 3A, which was added in 2026. They apply to businesses of every size. The Office of the Privacy Commissioner oversees the Act and publishes guidance.

Separately, the Unsolicited Electronic Messages Act 2007 governs commercial emails and text messages. The Department of Internal Affairs enforces it.

This guide covers the parts that most often affect a business website. It is general information for New Zealand businesses, not legal advice.

Contact forms

Collect only what you need

Every field on a form is information you are then responsible for. If you only need a name, an email address and a message to reply to an enquiry, do not ask for a date of birth, a home address or a phone number "just in case". Fewer fields also make forms quicker to complete, which tends to help enquiries.

Tell people what happens to their information

When you collect personal information directly from someone, the Privacy Act generally expects you to tell them why you are collecting it, who will receive it and how they can access or correct it. On a website, the usual approach is a short line near the form, with a link to a fuller privacy notice. For example: "We use these details to reply to your enquiry. See our privacy notice for how we store them."

Keep it secure

Form submissions should travel over HTTPS. Think about where submissions end up: an email inbox, a database, a customer management tool. Each is a place the information needs protecting. Delete enquiries you no longer need, according to a retention period you have decided on.

Information collected from third parties: IPP 3A

A new information privacy principle, IPP 3A, came into force on 1 May 2026 ^[1]. It requires agencies that collect personal information indirectly, meaning from someone other than the person it is about, to take reasonable steps to make the person aware of the collection ^[1].

There are exceptions. According to the Ministry of Justice, these include where the information is publicly available, and where the person has already been made aware by the original collector ^[1].

How might this affect a website? Consider a referral form where a customer enters a friend's details, a booking form where one person books for a group, or a service that pulls information about prospects from another source. In each case, you are collecting information about someone who did not give it to you directly. Check whether IPP 3A applies and, if so, how you will notify them.

Where your data is stored: overseas services

Many website tools store data outside New Zealand: hosting providers, email services, form builders, analytics, customer management systems. That is common and not in itself a problem, but it has privacy implications.

Using a provider to store or process data

The Office of the Privacy Commissioner explains that under section 11 of the Privacy Act, if a provider only holds or processes information on your behalf and does not use or disclose it for its own purposes, the information is treated as held by you ^[2]. You remain responsible for it, including making sure the provider keeps it secure.

Disclosing information overseas

IPP 12 deals with disclosing personal information to someone outside New Zealand who will use it for their own purposes. Broadly, you can do this if the recipient is subject to comparable privacy safeguards, or if the person has authorised the disclosure after being expressly informed that the recipient may not be required to protect the information in a comparable way ^[3]. There are other limited grounds set out in the principle.

What to do in practice

• List every tool your site uses that receives personal information, and where each stores it.
• Check each provider's terms to see whether it uses data for its own purposes.
• Mention overseas storage or processing in your privacy notice.

Privacy breaches

A privacy breach includes unauthorised access to, or disclosure, alteration, loss or destruction of, personal information. On a website, examples include a hacked contact form database, an inbox accessed by someone who should not have it, or a misconfigured file that exposes customer details.

If a breach has caused or is likely to cause serious harm, it is a notifiable privacy breach ^[4]. You must notify the Privacy Commissioner and affected people as soon as practicable. The Office of the Privacy Commissioner says it expects notification within 72 hours of becoming aware of a notifiable breach ^[4].

During a redesign, think about how you would detect a breach and who would deal with it. Keeping only the information you need reduces the harm if something does go wrong.

Newsletters and marketing emails

If your redesigned site has a newsletter sign-up or sends marketing emails, the Unsolicited Electronic Messages Act applies. The Department of Internal Affairs summarises the requirements for commercial electronic messages as consent, accurate sender information and a functional unsubscribe facility ^[5]. The Act covers email, fax, instant messaging and text messages, but not pop-up adverts or voice calls ^[5].

Consent

Get clear consent. A sign-up box that people tick themselves, with wording that says what they are signing up for, is the simplest approach. Avoid pre-ticked boxes.

Unsubscribe

Every commercial message needs a working way to unsubscribe. According to the Department of Internal Affairs, unsubscribe requests must be acted on within five working days, the facility must keep working for at least 30 days after the message is sent and it must be free to use ^[6].

Sender information

Messages must clearly identify who sent them and how to contact the sender ^[5].

A privacy checklist for your redesign

1. List every form on the site and the fields each collects. Remove fields you do not need.
2. Add a short privacy line near each form, linking to your privacy notice.
3. Update the privacy notice to describe what you collect, why, where it is stored and who receives it, including overseas providers.
4. Check whether any form collects information about someone other than the person filling it in, and whether IPP 3A applies.
5. Confirm all forms use HTTPS and that submissions are stored securely.
6. Decide how long you keep enquiries, and delete them after that period.
7. Check newsletter sign-ups use active consent and that every email has a working unsubscribe.
8. Note who would handle a privacy breach and how.

Cookies and analytics

New Zealand does not have a cookie-specific law like the European rules, but cookies and analytics tools can collect personal information, so the Privacy Act's principles still apply. Be open about what tools you use in your privacy notice or a cookie notice, and use privacy-respecting settings where available.

Privacy questions

Do small businesses have to follow the Privacy Act?

Yes. The Privacy Act applies to organisations of every size, including sole traders, when they collect and hold personal information.

Do I need a privacy notice on my website?

If your site collects personal information, telling people what you collect and why is part of meeting the Privacy Act. A privacy notice linked from each form is the usual way to do that.

Is it a problem that my email provider stores data overseas?

Not necessarily. If the provider only stores the data for you, you are treated as still holding it, and you remain responsible for protecting it. Mention overseas storage in your privacy notice.

Sources

Each source was opened and checked against the sentence it supports on 3 November 2026.

1. New privacy information principle now in force (published by Ministry of Justice; checked 3 November 2026) Government
2. Sending information overseas (published by Office of the Privacy Commissioner; checked 3 November 2026) Regulator
3. Principle 12 - Disclosure outside New Zealand (published by Office of the Privacy Commissioner; checked 3 November 2026) Regulator
4. What is a notifiable privacy breach? (published by Office of the Privacy Commissioner; checked 3 November 2026) Regulator
5. New Zealand spam law (published by Department of Internal Affairs; checked 3 November 2026) Government
6. Information about unsubscribing (published by Department of Internal Affairs; checked 3 November 2026) Government