Data Processing Addendum Template for New Zealand

A Data Processing Addendum (DPA) is a critical legal document that supplements your main service agreement when engaging third-party processors to handle personal information on your behalf. Under New Zealand's Privacy Act 2020, you have specific obligations when sharing personal data with service providers, making a properly drafted DPA essential for legal compliance and risk management.

When do you need this document?

You need a Data Processing Addendum whenever you engage a service provider who will access, store, or process personal information as part of their services. This includes cloud storage providers, payroll processors, marketing agencies handling customer data, IT support companies accessing employee information, or any contractor who may encounter personal data during service delivery. The document is particularly important for international service providers, as it helps ensure compliance with both New Zealand privacy laws and overseas data protection requirements. Without a DPA, you may be in breach of your obligations under the Privacy Act 2020 and could face regulatory action or civil claims.

Key legal considerations

Your DPA must clearly define the scope and purpose of data processing, specifying what types of personal information will be processed and for what purposes. Security measures are crucial - the document should outline technical and organizational safeguards, including encryption requirements, access controls, and data retention policies. Breach notification procedures must be established, detailing how quickly the processor must notify you of any privacy breaches and what information must be provided. The agreement should address sub-processor arrangements, requiring your consent before engaging additional parties and ensuring they meet the same security standards. International data transfer provisions are essential if data may be processed or stored overseas, including adequate protection mechanisms and legal safeguards.

Legal requirements in New Zealand

Under the Privacy Act 2020, you remain accountable for personal information even when processed by third parties, making contractual protections vital. The Act requires that personal information be protected by reasonable security safeguards and processed only for lawful purposes. Your DPA must ensure the processor complies with the privacy principles, particularly around collection limitations, use restrictions, and security safeguards. Mandatory data breach notification requirements mean your agreement must establish clear reporting timelines and procedures. The processor must also cooperate with privacy impact assessments and respond to data subject requests. If processing involves consumer data, Fair Trading Act 1986 considerations around truthful representations become relevant. For electronic marketing data, compliance with the Unsolicited Electronic Messages Act 2007 may also be required.