Online Privacy Notice Template for New Zealand

Your website's Online Privacy Notice is more than just a legal formality—it's a mandatory requirement under New Zealand's Privacy Act 2020 that protects both your organization and your users. This document serves as the foundation of trust between your business and website visitors, clearly outlining how you handle their personal information and what rights they have regarding their data.

When do you need this document?

You need an Online Privacy Notice if you operate any website, mobile app, or online service that collects personal information from users in New Zealand. This includes e-commerce sites collecting customer details, blogs with newsletter subscriptions, service providers gathering client information, or any platform using analytics tools that track user behavior. Even if you only collect basic information like email addresses or use third-party services like Google Analytics, you're required to have a compliant privacy notice accessible on your website.

Key legal considerations

Your Online Privacy Notice must address several critical elements to ensure compliance. You need to clearly identify what types of personal information you collect, whether directly from users or through automated means like cookies and tracking pixels. The notice must explain your purposes for collecting this information, how long you retain it, and with whom you share it. You're also required to inform users about their rights under the Privacy Act 2020, including their right to access, correct, and request deletion of their personal information. If you experience a data breach that could cause serious harm, your notice should explain your breach notification procedures. Additionally, you must provide clear contact information for privacy-related inquiries and explain how users can make complaints about your privacy practices.

Legal requirements in New Zealand

Under the Privacy Act 2020, your Online Privacy Notice must comply with the 13 Information Privacy Principles, particularly principles relating to collection, use, disclosure, and security of personal information. The notice must be written in plain language that ordinary users can understand, avoiding complex legal jargon. You're required to make it easily accessible, typically through a prominent link in your website footer or main navigation. If you collect information from children under 16, you need explicit consent from parents or guardians and must clearly explain this in your notice. For organizations sending commercial electronic messages, your privacy notice must also align with the Unsolicited Electronic Messages Act 2007, explaining how users can unsubscribe and how you obtained their consent. The Privacy Commissioner has enforcement powers, and non-compliance can result in significant penalties, making a comprehensive and accurate privacy notice essential for legal protection.