Customer and Product Data Act 2025

1: Title
This Act is the Customer and Product Data Act 2025.
2: Commencement
This Act comes into force on 30 March 2025. Section 2 editorial change 24 April 2025 sections 86(1) 87(m) Legislation Act 2019
1: Preliminary provisions
Purpose
3: Purpose
1: The purpose of this Act is to establish a framework to—
a: realise the value of certain data for the benefit of customers and society; and
b: promote competition and innovation for the long-term benefit of customers; and
c: facilitate secure, standardised, and efficient data services in certain sectors of the New Zealand economy.
2: The purpose is to be achieved by—
a: improving the ability of customers, and third parties they authorise, to access and use the data held about them by participants in those sectors; and
b: improving access to data about products in those sectors; and
c: requiring certain safeguards, controls, standards, and functionality in connection with those data services. Overview
4: Overview
1: This Act regulates data services provided by persons that are designated as data holders under subpart 3
2: Services relating to customer data are regulated as follows: The following table is small in size and has 2 columns. If ... A person (a data holder) is specified, or belongs to a class specified, in designation regulations; and it holds customer data of the kind specified in the regulations; and either— a customer requests the data or requests that the data holder perform an action; or an accredited requestor authorised by the customer requests the data or requests that the data holder perform an action. Then ... The data holder must comply with the request ( sections 14 15 18 19 However ... Certain protections apply, including duties to— confirm that the customer has authorised the request ( section 39 check the identity of the person who makes the request ( section 45 have a complaints process ( section 48 In addition,— the data holder may or must refuse the request in certain circumstances ( sections 16 20 only a person granted accreditation under subpart 4 an accredited requestor may only act within the class of its accreditation.
3: Services relating to product data are regulated as follows: The following table is small in size and has 2 columns. If ... A person (a data holder) is specified, or belongs to a class specified, in designation regulations; and it holds product data of the kind specified in the regulations; and a person requests the data. Then ... The data holder must comply with the request ( section 22 However ... The data holder may refuse the request in certain circumstances ( section 23
4: Additional details are set out in secondary legislation, including as follows: The following table is small in size and has 2 columns. Designation regulations which designate the data holders and classes of data that are regulated under this Act ( subpart 3 Other regulations which specify general requirements relating to regulated data services ( section 131 Standards which specify technical requirements relating to regulated data services ( section 138
5: Data holders and accredited requestors may be granted exemptions under section 141
6: This section is only a guide to the general scheme and effect of this Act. Interpretation
5: Interpretation
1: In this Act, unless the context otherwise requires,— accredited requestor section 7 authorisation authorise section 37 chief executive civil liability provision section 69(2) confirmation section 39(2) court see sections 92 93 customer section 8(1) customer data section 8(2) data data holder section 6 deception section 240(2) designated action designated customer data section 8(3) designated product data section 9 designation regulations
a: means designation regulations made under section 104
b: in relation to a person that is a data holder, means any designation regulations that have the effect of designating that person director section 6 document section 4 goods section 2(1) infringement fee infringement offence involved in a contravention IPP section 22 IPP 6 section 22 Minister Ministry New Zealand Business Number New Zealand Business Number Act 2016 personal information section 7 product section 9(1) product data section 9(2) register subpart 7 regulated data service section 10 regulations secondary user section 24(4) senior manager A serious threat section 16(3) services section 2(1) standard section 138 valid request section 26
2: In this Act, a person is involved in a contravention
a: has aided, abetted, counselled, or procured the contravention; or
b: has induced, whether by threats or promises or otherwise, the contravention; or
c: has been in any way, directly or indirectly, knowingly concerned in, or party to, the contravention; or
d: has conspired with others to effect the contravention.
6: Data holder
A person is a data holder
a: the person is specified, or belongs to a class specified, in designation regulations; and
b: either—
i: the person holds designated customer data or designated product data (or both); or
ii: another person holds that data on behalf of the person described in paragraph (a).
7: Accredited requestor
A person is an accredited requestor subpart 4
8: Customer, customer data, and designated customer data
1: Customer
2: Customer data
3: Designated customer data
9: Product, product data, and designated product data
1: Product
2: Product data
a: means data that is about, or relates to, 1 or more of the data holder’s products; but
b: does not include customer data.
3: Designated product data
10: Regulated data service
Regulated data service
a: providing data under section 14 15 22
b: performing an action under section 18 19 Territorial application of Act
11: Territorial application of Act
1: This Act applies to—
a: a New Zealand agency ( A
b: an overseas agency ( B
2: For the purposes of subsection (1), it does not matter—
a: where the data is, or was, collected by or on behalf of the agency; or
b: where the data is held by or on behalf of the agency; or
c: where the customer or product concerned is, or was, located.
3: For the purposes of subsection (1)(b), an agency may be treated as carrying on business in New Zealand without necessarily—
a: being a commercial operation; or
b: having a place of business in New Zealand; or
c: receiving any monetary payment for the supply of goods or services; or
d: intending to make a profit from its business in New Zealand.
4: This Act also applies to any conduct that occurs (in whole or in part) in New Zealand.
5: Subsection (4) does not limit subsection (1).
6: In this section, New Zealand agency overseas agency subpart 2 2020 No 31 s 4 Transitional, savings, and related provisions
12: Transitional, savings, and related provisions
The transitional, savings, and related provisions (if any) set out in Schedule 1 Act binds the Crown
13: Act binds the Crown
This Act binds the Crown.
2: Regulated data services
1: Main obligations
Customer data
14: Data holder must provide customer data to customer
1: This section applies if—
a: a customer requests that a data holder provides data to the customer; and
b: the data is designated customer data that is about that customer; and
c: the request—
i: is a valid request; and
ii: is made using the system described in section 27
d: the data holder has verified the identity of the person who made the request under section 45(2)
2: The data holder must provide the data to the customer using that system.
15: Data holder must provide customer data to accredited requestor if customer’s authorisation is confirmed
1: This section applies if—
a: an accredited requestor ( A
b: the data holder has carried out confirmation in relation to the request under section 39
c: the data is designated customer data that is about that customer; and
d: the request—
i: is a valid request; and
ii: is made using the system described in section 27
e: A is acting within the class of its accreditation; and
f: the data holder has verified the identity of the person who made the request under section 45(2)
2: The data holder must provide the data to A using that system.
16: Data holder may or must refuse request for data in certain circumstances
1: Despite sections 14 15
a: if the disclosure of the data would be likely to pose a serious threat to the life, health, or safety of any individual, or to public health or public safety ( see
b: if the data holder reasonably believes that disclosure of the data would create a significant likelihood of serious harassment of an individual; or
c: if the data holder reasonably believes that disclosure of the data would create a significant likelihood of serious financial harm to any person; or
d: if the data holder reasonably believes that it is likely that the request was made (wholly or in part) as a consequence of deception; or
e: if the data holder reasonably believes that disclosure of the data would be likely to have a materially adverse effect on the security, integrity, or stability of either or both of the following:
i: the data holder’s information and communication technology systems:
ii: the register; or
f: in the case of section 14
g: in the case of section 15
h: in the case of section 15
i: in the circumstances prescribed in the regulations or standards.
2: Despite sections 14 15
3: In this Act, serious threat
a: the likelihood of the threat being realised; and
b: the severity of the consequences if the threat is realised; and
c: the time at which the threat may be realised.
17: Sections 14 and 15 do not prevent request to access personal information being made in some other manner
Sections 14 15 Guidance note
IPP 6 is set out in section 22 Designated actions
18: Data holder must perform certain actions on customer’s request
1: This section applies if—
a: a customer requests that a data holder perform an action relating to the customer; and
b: the requested action is a designated action; and
c: the data holder would ordinarily perform the action to which the request relates in the course of the data holder’s business ( see
d: the request—
i: is a valid request; and
ii: is made using the system described in section 27
e: the data holder has verified the identity of the person who made the request under section 45(2)
2: The data holder must perform the action.
3: When considering whether a data holder would ordinarily perform an action in the course of its business, regard must be had to the matters (if any) prescribed in the regulations and the standards.
19: Data holder must perform certain actions on accredited requestor’s request if customer’s authorisation is confirmed
1: This section applies if—
a: an accredited requestor ( A
b: the data holder has carried out confirmation in relation to the request under section 39
c: the requested action is a designated action; and
d: the data holder would ordinarily perform the action to which the request relates in the course of the data holder’s business ( see
e: the request—
i: is a valid request; and
ii: is made using the system described in section 27
f: A is acting within the class of its accreditation; and
g: the data holder has verified the identity of the person who made the request under section 45(2)
2: The data holder must perform the action.
3: When considering whether a data holder would ordinarily perform an action in the course of its business, regard must be had to the matters (if any) prescribed in the regulations and the standards.
20: Data holder may or must refuse to perform actions in certain circumstances
1: Despite sections 18 19
a: if performing the action would be likely to pose a serious threat to the life, health, or safety of any individual, or to public health or public safety ( see section 16(3)
b: if the data holder reasonably believes that performing the action would create a significant likelihood of serious financial harm to any person; or
c: if the data holder reasonably believes that it is likely that the request was made (wholly or in part) as a consequence of deception; or
d: if the data holder reasonably believes that performing the action would be likely to have a materially adverse effect on the security, integrity, or stability of either or both of the following:
i: the data holder’s information and communication technology systems:
ii: the register; or
e: in the case of section 18
f: in the case of section 19
g: in the case of section 19
h: in the circumstances prescribed in the regulations or standards.
2: Despite sections 18 19 Joint customers
21: How data holders and accredited requestors must deal with joint customers
1: This section applies to a regulated data service provided in connection with 2 or more joint customers.
2: A data holder and an accredited requestor must deal with the joint customers in the manner prescribed by the regulations, including in connection with the following:
a: when or how the joint customers may or must make a request or give an authorisation under this subpart:
b: how the data holder or accredited requestor may or must deal with a request or authorisation from 1 or more of the joint customers:
c: when a request made, or an authorisation given, by 1 or more of the joint customers must be treated as effective (or ineffective) for the purposes of this Act.
3: Regulations made for the purposes of this section may (without limitation) provide for any of the following:
a: allowing or requiring a data holder or an accredited requestor to deal with a request or an authorisation in any of the following ways (on the terms and conditions (if any) specified in the regulations):
i: that a request or an authorisation may be made or given by any 1 or more of the joint customers (without the other joint customers):
ii: that a request or an authorisation may be made or given only by 2 or more of the joint customers acting together:
iii: that a request or an authorisation may be made or given only if it is made or given by all of the joint customers acting together:
iv: that a request or an authorisation may not be made or given by or on behalf of the joint customers:
b: allowing 1 or more joint customers to view or change permissions for how those joint customers may or must make a request or give an authorisation.
4: Sections 14 20
5: In this section, 2 or more customers are joint customers
a: they jointly hold a financial product issued by the data holder; or
b: they have rights or obligations under the same agreement with the data holder.
6: In subsection (5), financial product section 7 Example
Two people, A and B, have a joint bank account. The regulations may require a data holder to— allow A and B to authorise A or B acting alone to make a request or give an authorisation in certain circumstances; or require both A and B acting together to make a request or give an authorisation in other circumstances. Product data
22: Data holder must provide product data to any person
1: This section applies if—
a: a person requests that a data holder provides data to the person; and
b: the data is designated product data; and
c: the request—
i: is a valid request; and
ii: is made using the system described in section 27
2: The data holder must provide the data to the person using that system.
23: Data holder may refuse request for data in certain circumstances
Despite section 22
a: if the data holder reasonably believes that disclosure of the data would be likely to have a materially adverse effect on the security, integrity, or stability of either or both of the following:
i: the data holder’s information and communication technology systems:
ii: the register; or
b: in the circumstances prescribed in the regulations or standards.
2: Additional obligations
Secondary users
24: How data holders and accredited requestors must deal with secondary users
1: A data holder and an accredited requestor must deal with a secondary user in the manner prescribed by the regulations, including in connection with the following:
a: when or how a secondary user may or must make a request or give an authorisation under subpart 1
b: how the data holder or an accredited requestor may or must deal with a request or an authorisation from a secondary user; and
c: when a request made or an authorisation given by a secondary user must be treated as effective (or ineffective) for the purposes of this Act.
2: Regulations made for the purposes of subsection (1) may (without limitation) provide for any of the following:
a: whether, when, or how a person may or must be approved, or treated as being approved, to do either or both of the following:
i: make a request under subpart 1
ii: give an authorisation under subpart 1
b: when or how the approval referred to in paragraph (a) may be viewed, changed, or revoked.
3: Sections 14 20
4: A person ( A secondary user B
a: A is specified, or belongs to a class specified, in designation regulations as a secondary user in relation to a class of customers; and
b: B belongs to that class of customers; and
c: where required by the regulations, A has been approved, or is treated as being approved, as a secondary user in the manner required by the regulations (and that approval has not been revoked or otherwise ceased to be in effect). Examples
Banking sector Under this example, banks are designated for the purposes of section 6 The designation regulations could specify an authorised signatory for a bank account as a secondary user. If the customer is a company, the regulations may provide for an authorised signatory for the company’s bank account to make a request or give an authorisation on behalf of the company. Electricity sector Under this example, electricity retailers are designated for the purposes of section 6 The designation regulations could specify that certain members of a customer’s household may be a secondary user. If the customer is a particular member of the household, the regulations may provide for other members of the household to make a request or give an authorisation on behalf of the customer.
5: If regulations provide for approval of a person as a secondary user, the regulations may also provide for the manner in which the approval may or must be given, viewed, changed, or revoked.
25: Regulations may require requests to be made or authorisations to be given only by secondary users
1: This section applies if the regulations provide that a particular kind of customer may make a request or authorise an accredited requestor to make a request under subpart 1
2: A request or an authorisation in respect of the customer is of no effect under subpart 1 Example
The regulations may provide that, if a customer is a company, the company must authorise at least 1 secondary user to act on its behalf under subpart 1 A request or an authorisation in respect of a company may only be made through a secondary user. Valid requests
26: When request is valid
A request is a valid request
a: specifies the data or action being requested; and
b: complies with the requirements provided for in the standards about making requests (if any); and
c: otherwise makes the request in the manner prescribed in the regulations (if any). Electronic system
27: Data holder must operate electronic system for providing regulated data services
A data holder must operate an electronic system that has the capacity to do all of the following with reasonable reliability:
a: enable the data holder to receive requests for regulated data services; and
b: enable the data holder to provide regulated data services in response to those requests or to otherwise respond to those requests (including where the service must not or may not be provided).
28: Electronic system must comply with prescribed technical or performance requirements
1: A data holder must ensure that the electronic system referred to in section 27
2: Regulations or standards made for the purposes of this section may (without limitation) relate to any of the following:
a: security and identity verification measures:
b: reliability and timeliness of responses to requests for regulated data services:
c: availability:
d: usability:
e: accessibility:
f: monitoring use and functionality:
g: reporting on any of the matters referred to in paragraphs (a) to (f) (including to the chief executive).
29: Chief executive may require data holder to test electronic system
1: The chief executive may, by written notice, require a data holder to—
a: ensure that its electronic system is tested for the purpose of verifying that the system complies with some or all of the technical or performance requirements referred to in section 28
b: give a report to the chief executive on the testing.
2: The data holder must comply with subsection (1)(a) and (b) within the time and in the manner specified in the notice.
3: See sections 145 146
30: Offence for failing to comply with notice to test electronic system
1: A person commits an offence if the person—
a: refuses or fails, without reasonable excuse, to comply with a notice under section 29
b: in purported compliance with a notice under section 29
2: A person that commits an offence against subsection (1) is liable on conviction to a fine not exceeding—
a: $100,000 in the case of an individual:
b: $300,000 in any other case. Requirements for requests, providing services, and making information available
31: Data holders must comply with requirements for requests, providing services, and making information available
1: A data holder must comply with the requirements specified in the regulations and the standards in connection with the following:
a: receiving requests for regulated data services (including in relation to performing an action):
b: providing those services or otherwise responding to those requests:
c: notifying or otherwise making available information to any of the persons referred to in subsection (3).
2: The requirements must be complied with in the manner prescribed in the regulations or standards.
3: For the purposes of subsection (1)(c), a data holder may be required to notify or otherwise make available information to any of the following:
a: a customer:
b: a secondary user:
c: another person that is a data holder:
d: an accredited requestor:
e: the chief executive:
f: any member of the public or any class of the public.
32: Requirements for data holders in regulations or standards
1: Regulations or standards made for the purposes of section 31 Charges in connection with regulated data services
a: requirements about charging amounts payable in connection with regulated data services, including—
i: when an amount may, must, or must not be charged; and
ii: prohibitions or restrictions relating to charging those amounts (for example, a cap on how much may be charged): Notifying or otherwise making available information
b: the information that must be notified or otherwise made available to any person referred to in section 31(3) Data
c: the format and description of data:
d: the manner in which requests for regulated data services are received and responded to (for example, a requirement to use an application programming interface (API)):
e: data quality: Confirmation
f: the manner in which authorisations are confirmed under section 39(2)
2: In this section, data Guidance note
See subpart 9
33: Accredited requestors must comply with requirements for making information available
1: An accredited requestor must comply with the requirements specified in the regulations and the standards in connection with notifying or otherwise making available information to any of the persons referred to in subsection (2).
2: An accredited requestor may be required to notify or otherwise make available information to any of the following:
a: a customer:
b: a secondary user:
c: a data holder:
d: another accredited requestor:
e: the chief executive:
f: any member of the public or any class of the public.
34: Requirements in regulations or standards for accredited requestors to make information available
Regulations or standards made for the purposes of section 33
a: the information that must be notified or otherwise made available to any person referred to in section 33(2)
b: the times at which, or the events on the occurrence of which, information must be notified or made available; and
c: the manner of notifying or making available the information (including prescribing the manner in which the information must be presented, calculated, or prepared). Guidance note
See subpart 9
35: Contravention of specified disclosure requirement is infringement offence
1: A person that contravenes a specified disclosure requirement commits an infringement offence and is liable to—
a: an infringement fee of $20,000; or
b: a fine imposed by a court not exceeding $50,000.
2: In this section and section 70 specified disclosure requirement section 31(1)(c) 32(1)(b) 33(1) 34
36: Accredited requestor must not act if reasonable grounds to believe authorisation or instruction is given under threat of physical or mental harm
An accredited requestor must not accept an authorisation, or make a request on the instruction of a customer or secondary user, if the accredited requestor has reasonable grounds to believe that the authorisation or instruction is given under the threat of physical or mental harm.
3: Protections
Authorisation
37: Giving authorisation
1: A customer (or a secondary user on their behalf) has given an authorisation A
a: the customer (or secondary user) gave the authorisation expressly, including by specifying any limits on the scope of the authorisation; and
b: at the time of giving the authorisation, the customer (or secondary user) was reasonably informed about the matter to which the authorisation relates (including about the purpose of the authorisation); and
c: the authorisation was otherwise given in the manner (if any) prescribed by the regulations and the standards; and
d: the authorisation has not ended.
2: To authorise
38: Ending authorisation
An authorisation ends on the earliest of the following:
a: the expiry of the maximum period for an authorisation specified by the regulations (if any):
b: the occurrence of an event specified by the regulations (if any) (for example, when the customer closes an account with a data holder):
c: the time (if any) specified by the customer (or a secondary user on their behalf) when the authorisation is given:
d: the time (if any) that the customer (or a secondary user on their behalf) ends the authorisation ( see section 40
e: the time (if any) determined by the accredited requestor.
39: Authorisation must be confirmed
1: This section applies if a data holder receives a request from an accredited requestor to provide a regulated data service relating to a customer.
2: The data holder must check that the service is within the scope of the authorisation given by the customer (or by a secondary user on their behalf) ( confirmation
3: The data holder must not provide the regulated data service until confirmation has been completed.
4: A confirmation is valid for any service within the scope of that authorisation until the time when the scope of the authorisation is modified or the authorisation ends (whichever is earlier).
5: If the scope of the authorisation is modified or the authorisation ends, subsection (2) applies again. Example
A customer authorises their electricity provider (a data holder) to provide details of their electricity usage to a company that makes recommendations about the best electricity deals in the market. Before sharing any of the customer’s data for the first time, the electricity provider must confirm the customer’s authorisation. However, it is not necessary to carry out confirmation for any subsequent actions performed within the scope of that authorisation. The electricity provider will only have to reconfirm the customer’s authorisation if the scope of the authorisation is modified or the authorisation ends.
6: A person that carries out a confirmation must carry out the confirmation in the manner (if any) prescribed by the regulations and the standards (for example, the regulations or standards may require the person that carries out a confirmation to verify the identity of the customer or secondary user).
40: Customer or secondary user must be able to control authorisation
1: If a data holder has confirmed an authorisation under section 39
a: must have systems in place to enable the customer or secondary user (as the case may be) to view or end the authorisation; and
b: must ensure that those systems meet the requirements (if any) provided for by the regulations and the standards.
2: If a customer (or a secondary user on their behalf) has given an accredited requestor an authorisation, the accredited requestor—
a: must have systems in place to enable the customer or secondary user (as the case may be) to view or end the authorisation; and
b: must ensure that those systems meet the requirements (if any) provided for by the regulations and the standards.
3: The data holder or accredited requestor must ensure that the systems are able to give immediate effect to the ending of an authorisation.
41: Accredited requestor must comply with prescribed duties in respect of authorisation
1: If an accredited requestor ( A
a: A must take the prescribed steps (if any) to enable the customer or secondary user (as the case may be) to be reasonably informed about the matter to which the authorisation relates; and
b: A must use only prescribed methods (if any) to obtain the authorisation (for example, a tool that requires the customer to perform an affirmative action in order to give the authorisation); and
c: A must not obtain, or accept, an authorisation from a customer (or secondary user) in the prescribed circumstances (for example, if A has not verified the identity of the customer or secondary user); and
d: A must comply with any other prescribed requirements in connection with obtaining, or accepting, the authorisation.
2: In this section, prescribed
42: Authorisation must not be required as condition of providing product
1: This section applies if a person provides to a customer goods or services other than regulated data services ( products
2: The person must not, as a condition of providing a product, require the customer to authorise a regulated data service unless that service is reasonably necessary to enable the person to provide the product. Restriction on who may request regulated data service
43: Only customer, secondary user, or accredited requestor may request regulated data service
1: A person must not request, or purport to request, a regulated data service that relates to a customer unless the person is—
a: the customer; or
b: a secondary user who is acting on behalf of the customer in accordance with section 24
c: an accredited requestor that is—
i: authorised by the customer to request the service; and
ii: acting within the class of its accreditation.
2: An accredited requestor does not contravene this section if—
a: a customer (or a secondary user on their behalf) has ended an authorisation; and
b: the accredited requestor did not know, and could not reasonably be expected to know, that the authorisation had ended.
44: Offence for contravention of request restriction
1: A person commits an offence if the person—
a: requests, or purports to request, a regulated data service that relates to a customer in contravention of section 43
b: knows that they are not permitted to make the request.
2: A person that commits an offence against this section is liable on conviction,—
a: in the case of an individual, to imprisonment for a term not exceeding 5 years or to a fine not exceeding $1 million (or both):
b: in any other case, to a fine not exceeding $5 million.
45: Verification of identity of person who makes request
1: This section applies if a data holder receives a request to provide a regulated data service relating to a customer.
2: The data holder—
a: must verify the identity of the person who made the request; and
b: must not provide the regulated data service until it has complied with paragraph (a).
3: The data holder must verify the identity of a person in the manner (if any) prescribed by the regulations and the standards. Record keeping
46: Data holder must keep records about regulated data service
1: A data holder must keep records of the following matters in respect of any regulated data service that the data holder provides:
a: the request made for the service (including the time at which the request was made):
b: whether the data holder has given effect, or has attempted to give effect, to the request:
c: the authorisation given by or on behalf of the customer (if any), including—
i: any limitations on the scope of the authorisation; and
ii: any modifications to the authorisation; and
iii: the time (if any) at which the authorisation ended (if the data holder is aware of that information):
d: whether the authorisation (if any) has been confirmed under section 39 section 45
e: the information specified by the regulations (if any).
2: Subsection (1)(c) to (e) does not apply to product data requests.
3: The records must be kept—
a: for 5 years from the date of the request; and
b: otherwise in the manner prescribed by the regulations (if any).
4: If a person ceases to be a data holder, this section continues to apply with all necessary modifications as if the person were still a data holder.
5: A person that contravenes this section commits an infringement offence and is liable to—
a: an infringement fee of $20,000; or
b: a fine imposed by a court not exceeding $50,000.
47: Accredited requestor must keep records about regulated data service
1: An accredited requestor must keep records of the following matters in respect of any regulated data service relating to a customer that the accredited requestor requests:
a: the request made for the service (including the time at which the request was made):
b: the authorisation given by or on behalf of the customer, including—
i: any limitations on the scope of the authorisation; and
ii: any modifications to the authorisation; and
iii: the time at which the authorisation was given; and
iv: the time (if any) at which the authorisation ended (if the accredited requestor is aware of that information):
c: the information specified by the regulations (if any).
2: The records must be kept—
a: for 5 years from the date of the request; and
b: otherwise in the manner prescribed by the regulations (if any).
3: If a person ceases to be an accredited requestor, this section continues to apply with all necessary modifications as if it were still an accredited requestor.
4: An accredited requestor that contravenes this section commits an infringement offence and is liable to—
a: an infringement fee of $20,000; or
b: a fine imposed by a court not exceeding $50,000. Complaints
48: Data holders and accredited requestors must have customer complaints process
1: A data holder or an accredited requestor ( A
a: allows customers to make complaints about A’s conduct in connection with regulated data services that A provides or requests; and
b: provides for how those complaints must be investigated and otherwise dealt with.
2: A must ensure that,—
a: as far as practicable, the process enables complaints to be investigated and otherwise dealt with fairly, efficiently, and effectively; and
b: the process meets the requirements provided for by the regulations (if any).
49: Data holder or accredited requestor must be member of dispute resolution scheme (if scheme has been prescribed)
1: This section applies to a data holder or an accredited requestor if, for the purposes of this section, 1 or more dispute resolution schemes have been prescribed by the regulations for a class of persons that includes the data holder or accredited requestor.
2: The data holder or accredited requestor must be a member of at least 1 of those schemes.
3: The regulations may prescribe a dispute resolution scheme only if the scheme has been established, approved, or otherwise authorised for any purpose under any other legislation. Examples of schemes that may be prescribed
A dispute resolution scheme approved under the Financial Service Providers (Registration and Dispute Resolution) Act 2008 A dispute resolution scheme within the meaning of section 95
50: Rules of scheme may be changed to provide for complaints about regulated data services
1: The person responsible for a scheme may, in the manner prescribed in the regulations, change the rules of a scheme to—
a: allow customers to make complaints about the conduct of a data holder or an accredited requestor ( A
b: provide for how those complaints must be investigated and otherwise dealt with; and
c: otherwise facilitate the scheme dealing with those complaints.
2: The regulations may disapply any requirement or restriction imposed under any other legislation in connection with a change to the rules of a scheme.
3: A change made under this section is effective despite anything to the contrary in any other legislation, including anything relating to the consent or approval of any person to the making of the change.
4: In this section, scheme Privacy Act 2020
51: Access request not IPP 6 request but contravention is interference with privacy
1: This section applies to a request that a data holder provide data under section 14 15
2: The request is not a request made under IPP 6 and, accordingly, nothing in subpart 1
3: However, if a data holder contravenes section 14 15 16(2) Parts 5 6 Guidance note
See section 135(4)(b) Privacy Act 2020
52: Certain contraventions relating to storage and security treated as breaching information privacy principle 5
1: If, in relation to any personal information, a data holder contravenes a CPD storage and security requirement, the data holder must be treated as breaching information privacy principle 5 set out in section 22 Parts 5 6 Guidance note
See section 135(4)(b) Privacy Act 2020
2: In this section, CPD storage and security requirement
a: section 39(3) 45(2)
b: a requirement that is imposed under this Act in connection with 1 or more of the following and that is specified by the regulations for the purposes of this section:
i: protecting data against loss:
ii: protecting data against access, use, modification, or disclosure that is not authorised by the data holder or an accredited requestor:
iii: protecting data against other misuse.
4: Regulatory and enforcement matters
1: Regulatory powers
53: Chief executive may require person to supply information or produce documents
1: If the chief executive considers it necessary or desirable for the purposes of performing or exercising their functions, powers, or duties under this Act, the chief executive may, by written notice served on any person, require the person—
a: to supply to the chief executive, within the time and in the manner specified in the notice, any information or class of information specified in the notice; or
b: to produce to the chief executive, or to a person specified in the notice acting on their behalf in accordance with the notice, any document or class of documents specified in the notice (within the time and in the manner specified in the notice); or
c: if necessary, to reproduce, or assist in reproducing, in usable form, information recorded or stored in any document or class of documents specified in the notice (within the time and in the manner specified in the notice).
2: Information supplied in response to a notice under subsection (1)(a) must be—
a: given in writing; and
b: signed in the manner specified in the notice.
3: If a document is produced in response to a notice, the chief executive, or the person to whom the document is produced, may—
a: inspect and make records of that document; and
b: take copies of the document or extracts from the document.
4: See sections 145 146 2011 No 5 s 25
54: Person has privileges of witness in court
Every person has the same privileges in relation to providing information and documents under section 53 2011 No 5 s 56(1)
55: Effect of proceedings
1: If a person commences a proceeding in any court in respect of the exercise of any powers conferred by section 53
a: the powers may be, or may continue to be, exercised as if the proceeding had not been commenced; and
b: no person is excused from fulfilling their obligations under that section by reason of the proceeding.
2: However, the High Court may make an interim order overriding the effect of subsection (1), but only if it is satisfied that—
a: the applicant has established a prima facie case that the exercise of the power in question is unlawful; and
b: the applicant would suffer substantial harm from the exercise or discharge of the power or obligation; and
c: if the power or obligation is exercised or discharged before a final decision is made in the proceeding, none of the remedies specified in subsection (3), or any combination of those remedies, could subsequently provide an adequate remedy for that harm; and
d: the terms of that order do not unduly hinder or restrict the chief executive in performing or exercising their functions, powers, or duties under this Act.
3: The remedies are as follows:
a: any remedy that the High Court may grant in making a final decision in relation to the proceeding (for example, a declaration):
b: any damages that the applicant may be able to claim in concurrent or subsequent proceedings:
c: any opportunity that the applicant may have, as defendant in a proceeding, to challenge the admissibility of any evidence obtained as a result of the exercise or discharge of the power or obligation. 2011 No 5 s 57
56: Effect of final decision that exercise of powers under section 53 unlawful
1: This section applies in any case where it is declared, in a final decision given in any proceeding in respect of the exercise of any powers conferred by section 53
2: To the extent to which the exercise of those powers is declared unlawful, the chief executive must ensure that, immediately after the decision of the court is given,—
a: any information obtained as a consequence of the exercise of powers declared to be unlawful and any record of that information are destroyed; and
b: any documents, or extracts from documents, obtained as a consequence of the exercise of powers declared to be unlawful are returned to the person previously having possession of them, or previously having them under their control, and any copies of those documents or extracts are destroyed; and
c: any information derived from or based on such information, documents, or extracts is destroyed.
3: However, the court may, in the court’s discretion, order that any information, record, or copy of any document or extract from a document may, instead of being destroyed, be retained by the chief executive subject to any terms and conditions that the court imposes.
4: No information, and no documents or extracts from documents, obtained as a consequence of the exercise of any powers declared to be unlawful and no record of any such information or document—
a: are admissible as evidence in any civil proceeding unless the court hearing the proceeding in which the evidence is sought to be adduced is satisfied that there was no unfairness in obtaining the evidence:
b: are admissible as evidence in any criminal proceeding if the evidence is excluded under section 30
c: may otherwise be used in connection with the exercise of any power conferred by this Act unless the court that declared the exercise of the powers to be unlawful is satisfied that there was no unfairness in obtaining the evidence. 2011 No 5 s 58
57: Offence for failing to comply with notice to supply information or produce documents
1: A person commits an offence if the person—
a: refuses or fails, without reasonable excuse, to comply with a notice under section 53
b: in purported compliance with a notice under section 53
2: A person that commits an offence against subsection (1) is liable on conviction to a fine not exceeding—
a: $100,000 in the case of an individual:
b: $300,000 in any other case. 2011 No 5 s 61
2: Duties to take remedial action
58: Data holder or accredited requestor must take prescribed steps to avoid, mitigate, or remedy loss or damage caused by contravention
1: This section applies if—
a: a person ( A
b: A is a data holder or an accredited requestor; and
c: a person ( B
2: A must take the steps that are prescribed by the regulations to avoid, mitigate, or remedy that loss or damage.
3: For the purposes of subsection (1)(c), B is any of the following:
a: a customer:
b: a data holder or an accredited requestor (other than A).
4: See section 131(2)
59: Person who has suffered loss or damage may recover amount as debt due
1: This section applies if regulations made for the purposes of section 58 A section 58(3) B
2: B may recover the amount from A in any court of competent jurisdiction as a debt due to B. Examples
Example 1 A data holder ( A B Example 2 An accredited requestor ( A B
60: Other remedies or powers not limited
Sections 58 59
a: any other remedy that a person may obtain for the loss or damage that has been, or is likely to be, suffered because of the contravention referred to in section 58
b: the powers of the chief executive, a court, or the Disputes Tribunal in respect of the contravention.
3: Prohibition against holding out
61: Prohibition against holding out
A person must not hold out that the person, or another person,—
a: is an accredited requestor if that is not the case; or
b: is lawfully able to do either of the following if that is not the case:
i: make a particular kind of request in connection with a regulated data service; and
ii: provide particular kinds of goods or services in connection with a regulated data service.
4: Infringement offences
62: Infringement offences
1: A person that is alleged to have committed an infringement offence may—
a: be proceeded against by the filing of a charging document under section 14
b: be issued with an infringement notice under section 63
2: Proceedings commenced in the way described in subsection (1)(a) do not require the leave of a District Court Judge or Registrar under section 21(1)(a)
3: See section 21
63: When infringement notice may be issued
The chief executive may issue an infringement notice to a person if the chief executive believes on reasonable grounds that the person is committing, or has committed, an infringement offence.
64: Revocation of infringement notice before payment made
1: The chief executive may revoke an infringement notice before—
a: the infringement fee is paid; or
b: an order for payment of a fine is made or deemed to be made by a court under section 21
2: The chief executive must take reasonable steps to ensure that the person to whom the notice was issued is made aware of the revocation of the notice.
3: The revocation of an infringement notice before the infringement fee is paid is not a bar to any further action as described in section 62(1)(a) or (b)
65: What infringement notice must contain
An infringement notice must be in the form prescribed in the regulations and must contain the following particulars:
a: details of the alleged infringement offence that fairly inform a person of the time, place, and nature of the alleged offence:
b: the amount of the infringement fee:
c: the address of the chief executive:
d: how the infringement fee may be paid:
e: the time within which the infringement fee must be paid:
f: a summary of the provisions of section 21(10)
g: a statement that the person served with the notice has a right to request a hearing:
h: a statement of what will happen if the person served with the notice neither pays the infringement fee nor requests a hearing:
i: any other matters prescribed in the regulations.
66: How infringement notice may be served
1: An infringement notice may be served on the person that the chief executive believes is committing or has committed the infringement offence by—
a: delivering it to the person or, if the person refuses to accept it, bringing it to the person's notice; or
b: leaving it for the person at the person's last known place of residence with another person who appears to be of or over the age of 14 years; or
c: leaving it for the person at the person's place of business or work with another person; or
d: if the person is a body corporate, delivering it to a director or an employee of the body corporate at its head office, principal place of business or work, or registered office, or by bringing it to the director’s notice or the employee’s notice if that person refuses to accept it; or
e: sending it to the person by prepaid post addressed to the person's last known place of residence or place of business or work; or
f: sending it to an electronic address of the person in any case where the person does not have a known place of residence or business in New Zealand.
2: If the person is a body corporate,—
a: subsection (1)(a) to (c) does not apply (but see
b: the infringement notice (or a copy of it) sent in accordance with subsection (1)(e) or (f) must be sent for the attention of a director or an employee of the body corporate.
3: Unless the contrary is shown,—
a: an infringement notice (or a copy of it) sent by prepaid post to a person under subsection (1) is to be treated as having been served on that person on the fifth working day after the date on which it was posted; and
b: an infringement notice sent to a valid electronic address is to be treated as having been served at the time the electronic communication first entered an information system that is outside the control of the chief executive.
67: Payment of infringement fees
All infringement fees paid for infringement offences must be paid to the chief executive.
68: Reminder notices
A reminder notice must be in the form prescribed in the regulations and must include the same particulars, or substantially the same particulars, as the infringement notice.
5: Civil liability
69: Civil liability remedies available under this subpart
1: The following remedies ( civil liability remedies
a: a pecuniary penalty order (with 2 tiers of penalties):
b: a declaration of contravention:
c: a compensatory order:
d: an injunction.
2: In this Act, civil liability provision section 71(1) Pecuniary penalty order
70: When High Court may make pecuniary penalty order
1: The High Court may, on the application of the chief executive, order a person to pay to the Crown the pecuniary penalty that the court determines to be appropriate if the court is satisfied that the person has—
a: contravened a civil liability provision; or
b: attempted to contravene a civil liability provision; or
c: been involved in a contravention of a civil liability provision.
2: However, an order may not be made for a contravention, an attempted contravention, or an involvement in a contravention of a specified disclosure requirement ( see section 35
3: In this subpart, relevant conduct
71: Maximum penalty (Tier 1)
1: This section applies to a contravention, an attempted contravention, or an involvement in a contravention of any of the following:
a: section 27
b: section 43
c: section 45
2: The maximum amount of a pecuniary penalty is—
a: $500,000 for a contravention, an attempted contravention, or an involvement in a contravention by an individual; or
b: $2,500,000 in any other case.
72: Maximum penalty (Tier 2)
1: This section applies to a contravention, an attempted contravention, or an involvement in a contravention of any of the following:
a: section 14
b: section 15
c: section 16(2)
d: section 18
e: section 19
f: section 20(2)
g: section 21
h: section 22
i: section 24
j: section 28
k: section 31
l: section 33
m: section 36
n: section 39
o: section 40
p: section 41
q: section 42
r: section 48
s: section 49
t: section 58
u: section 61
v: section 124
w: section 125
2: The maximum amount of a pecuniary penalty is—
a: $200,000 for a contravention, an attempted contravention, or an involvement in a contravention by an individual; or
b: $600,000 in any other case.
73: Considerations for court in determining pecuniary penalty
1: In determining an appropriate pecuniary penalty that a person ( A
a: the nature and extent of A’s conduct; and
b: the nature and extent of any loss or damage suffered by any person because of A’s conduct; and
c: any gains made or losses avoided by A; and
d: whether a person has paid an amount of compensation, reparation, or restitution, or taken other steps to avoid, mitigate, or remedy any loss or damage suffered by another person because of A’s conduct; and
e: the circumstances in which A’s conduct took place; and
f: whether A has previously been found by a court in a proceeding under this Act, or any other legislation, to have engaged in any similar conduct.
2: In this section, A’s conduct
74: Limit on pecuniary penalty for multiple contraventions of same or substantially similar nature
1: This section applies if—
a: the court finds, whether in the same or separate proceedings, that a person is liable to pay a pecuniary penalty in respect of 2 or more contraventions of the same civil liability provision; and
b: those contraventions are of the same or a substantially similar nature and occurred at or about the same time.
2: The total amount of any pecuniary penalty imposed on the person in respect of those contraventions must not exceed the amount of the maximum pecuniary penalty that may be imposed in respect of a single contravention. Declaration of contravention
75: Declaration of contravention
1: The High Court must, on an application under section 70
2: The High Court may also, on the application of the chief executive or any other person, make a declaration of contravention if it is satisfied that a person has contravened, or been involved in a contravention of, a civil liability provision.
76: Purpose and effect of declaration of contravention
1: The purpose of a declaration of contravention is to enable an applicant for a compensatory order to rely on the declaration of contravention in the proceeding for that order, and not be required to prove the contravention or involvement in the contravention.
2: Accordingly, a declaration of contravention is conclusive evidence of the matters that must be stated in it under section 77
77: What declaration of contravention must state
A declaration of contravention must state the following:
a: the provision to which the contravention or involvement in the contravention relates; and
b: the person that engaged in the contravention or was involved in the contravention; and
c: the conduct that constituted the contravention or involvement in the contravention. Compensatory orders
78: When court or Disputes Tribunal may make compensatory orders
1: The court or the Disputes Tribunal may make a compensatory order, on application by the chief executive or any other person, if the court or the Disputes Tribunal is satisfied that—
a: a person has contravened a civil liability provision; and
b: another person (the aggrieved person
2: However, the court or the Disputes Tribunal may not make a compensatory order for an interference with the privacy of an individual referred to in section 51(3) see instead section 102 section 103
3: The court or the Disputes Tribunal may make a compensatory order whether or not the aggrieved person is a party to the proceeding. Guidance note
Section 94
79: Terms of compensatory orders
1: If section 78
2: An order may include an order to direct a relevant person to pay to the aggrieved person the amount of the loss or damage (in whole or in part).
3: Subsection (2) does not limit subsection (1).
4: In this section, relevant person
a: any person in contravention; or
b: any person involved in the contravention. Injunctions
80: Court may grant injunctions
The court may, on application by the chief executive or any other person, grant an injunction—
a: restraining a person from engaging or continuing to engage in conduct that constitutes or would constitute a contravention, an attempted contravention, or an involvement in a contravention of a civil liability provision; or
b: requiring a person to do an act or a thing if—
i: that person has refused or failed, is refusing or failing, or is proposing to refuse or fail to do that act or thing; and
ii: the refusal or failure was, is, or would be a contravention of a civil liability provision.
81: When court may grant restraining injunctions
1: The court may grant an injunction restraining a person from engaging in conduct of a particular kind if—
a: it is satisfied that the person has engaged in conduct of that kind; or
b: it appears to the court that, if an injunction is not granted, it is likely that the person will engage in conduct of that kind.
2: The court may grant an interim injunction restraining a person from engaging in conduct of a particular kind if in its opinion it is desirable to do so.
3: Subsections (1)(a) and (2) apply whether or not it appears to the court that the person intends to engage again, or to continue to engage, in conduct of that kind.
4: Subsections (1)(b) and (2) apply whether or not—
a: the person has previously engaged in conduct of that kind; or
b: there is an imminent danger of substantial damage to any other person if that person engages in conduct of that kind.
82: When court may grant performance injunctions
1: A court may grant an injunction requiring a person to do an act or a thing that the person is required to do under a civil liability provision if—
a: it is satisfied that the person has refused or failed to do that act or thing; or
b: it appears to the court that, if an injunction is not granted, it is likely that the person will refuse or fail to do that act or thing.
2: The court may grant an interim injunction requiring a person to do an act or a thing that the person is required to do under a civil liability provision if in its opinion it is desirable to do so.
3: Subsections (1)(a) and (2) apply whether or not it appears to the court that the person intends to refuse or fail again, or to continue to refuse or fail, to do that act or thing.
4: Subsections (1)(b) and (2) apply whether or not—
a: the person has previously refused or failed to do that act or thing; or
b: there is an imminent danger of substantial damage to any other person if the person refuses or fails to do that act or thing.
83: Chief executive's undertaking as to damages not required
1: If the chief executive applies to the court for the grant of an interim injunction under this subpart, the court must not, as a condition of granting an interim injunction, require the chief executive to give an undertaking as to damages.
2: In determining the chief executive’s application for the grant of an interim injunction, the court must not take into account that the chief executive is not required to give an undertaking as to damages. Rules of procedure
84: Rules of civil procedure and civil standard of proof apply
A proceeding under this subpart is a civil proceeding and the usual rules of court and rules of evidence and procedure for civil proceedings apply (including the standard of proof).
85: Limit on proceedings
1: A proceeding under this subpart may be commenced within 3 years after the conduct giving rise to the contravention, attempted contravention, or involvement in the contravention was discovered or ought reasonably to have been discovered.
2: However, no proceeding under this subpart may be commenced 10 years or more after the conduct giving rise to the contravention, attempted contravention, or involvement in the contravention occurred. Relationship between proceedings and orders
86: More than 1 civil liability remedy may be given for same conduct
The court may grant a civil liability remedy of one kind against a person even though the court has granted another civil liability remedy of a different kind against the person for the same conduct. Example
The court may make a compensatory order and a pecuniary penalty order for the same conduct.
87: Only 1 pecuniary penalty order may be made for same conduct
If conduct by a person constitutes a contravention, an attempted contravention, or an involvement in the contravention of 2 or more provisions,—
a: a proceeding may be brought against that person for the contravention, attempted contravention, or involvement in the contravention of any 1 or more of the provisions; but
b: no person is liable to more than 1 pecuniary penalty order for the same conduct.
88: No pecuniary penalty and criminal penalty for same conduct
A person cannot be ordered to pay a pecuniary penalty and be liable for a fine or to imprisonment under this Act or any other Act for the same conduct. Defences
89: General defences for person in contravention
1: In any proceeding under this subpart against a person ( A
a: A’s contravention was due to reasonable reliance on information supplied by another person; or
b: both of the following apply:
i: A’s contravention was due to the act or default of another person, or to an accident or to some other cause beyond A’s control; and
ii: A took reasonable precautions and exercised due diligence to avoid the contravention.
2: For the purposes of subsection (1)(a) and (b), another person
3: Subsection (1)(b) does not apply to a contravention of—
a: section 27
b: section 28
4: In this section and section 90 CPD reliability and availability requirement
90: Defence for contraventions due to technical fault
1: In any proceeding under this subpart against a data holder ( A
a: A’s contravention was due to a technical fault in its electronic system referred to in section 27
b: A took reasonable precautions and exercised due diligence to avoid the contravention; and
c: A is in compliance with section 27 see section 89(4)
2: The provisions are as follows:
a: sections 14 15 18 19 22
b: section 39(2)
c: section 45(2)
91: Defence for providing data in compliance or purported compliance with this Act
1: This section applies to a claim against a data holder ( A
2: It is a defence if A proves that—
a: A provided the customer data in compliance, or purported compliance, with section 14 15
b: in providing the customer data,—
i: A was acting in good faith; and
ii: if this subparagraph applies, A took reasonable precautions and exercised due diligence to avoid a contravention of this Act.
3: Subsection (2)(b)(ii) applies if—
a: A provided the customer data in purported compliance with section 14 15
b: A did not have a duty to provide the customer data under either of those sections.
4: This section does not limit any liability, or other consequences, under this Act for a contravention of section 14 15 Jurisdiction
92: Jurisdiction of High Court
The High Court may hear and determine the following matters:
a: applications for orders, or for a court to exercise any other power, under any provision of this subpart:
b: appeals arising from any proceeding in the District Court under this subpart.
93: Jurisdiction of District Court
The District Court may hear and determine applications for orders, or for a court to exercise any other power, under any of the provisions of sections 78 83
a: the amount claimed does not exceed $350,000; or
b: no amount is claimed; or
c: the occasion for the making of the order or the exercise of the power arises in the course of civil proceedings properly before the court; or
d: the parties consent, under section 81
94: Jurisdiction of Disputes Tribunal
1: The Disputes Tribunal established under section 4 sections 78 79
2: An order of the Disputes Tribunal under this Act must not—
a: require a person to pay an amount exceeding $30,000; or
b: declare a person not liable to another person for an amount exceeding $30,000.
3: An order of the Tribunal that exceeds any restriction specified in subsection (2) is entirely of no effect.
5: Administrative matters
1: Chief executive’s functions
95: Chief executive’s functions
The chief executive’s functions under this Act are as follows:
a: to act as the regulator of regulated data services, including by—
i: issuing warnings, reports, or guidelines, or making comments, about any matter relating to regulated data services or persons engaged in conduct relating to those services (including in relation to 1 or more particular persons); and
ii: accrediting persons as accredited requestors; and
iii: issuing standards; and
iv: keeping the register; and
v: monitoring compliance with and enforcing this Act, including by investigating conduct that constitutes or may constitute a contravention, an attempted contravention, or an involvement in a contravention; and
vi: taking appropriate action in respect of persons that have contravened, are contravening, have attempted to contravene, or are likely to contravene this Act, or have been involved, are involved, or are likely to be involved in a contravention of this Act; and
vii: performing and exercising any other powers and duties conferred or imposed on the chief executive under this Act:
b: to provide services to promote the purpose of this Act:
c: to provide, or facilitate the provision of,—
i: information to customers, data holders, accredited requestors, and the public generally that is relevant to the purpose of this Act; and
ii: other information in connection with the functions or powers conferred or imposed on the chief executive under this Act:
d: to co-operate with any other law enforcement or regulatory agency that carries out a role in relation to regulated data services:
e: to keep under review the law and practices that are relevant to the chief executive’s other functions under this section (including overseas law and practices).
2: Chief executive may approve persons to have principal role in developing standards
96: When person must be approved under this subpart
1: Subsection (2) applies if the chief executive considers that—
a: it is necessary or desirable for a non-public service person to have the principal role in the development of any standards in relation to particular designation regulations; and
b: the person should be approved under this subpart in order to ensure that they are an appropriate person to perform that role.
2: The person may perform that role only if they are approved under this subpart.
3: Subsection (1)(a) must be treated as applying to a person if—
a: they have issued, or will issue, a standard, framework, code of practice, recommended practice, or requirement (the material
b: the chief executive proposes to incorporate by reference the material in any standards (whether in whole or in part, and with or without modification); and
c: the chief executive considers that the standards will be wholly or predominantly based on the material.
4: In this subpart,— approved person non-public service person section 10
97: Chief executive may approve person
1: The chief executive may approve a non-public service person under this subpart to have the principal role in the development of any standards in relation to particular designation regulations.
2: However, the power under subsection (1) does not include a power to delegate to an approved person the power to make standards ( see also section 102
3: A person approved under this section must be treated as being a national organisation under section 64(1)(a)
98: Criteria for approving person
1: Before approving a person under section 97
a: is a body corporate or an unincorporated body, and that the membership of the board or other governing body of the person has a reasonably balanced representation of stakeholder interests; and
b: will have in place fair and transparent processes for the development of standards; and
c: has sufficient knowledge, experience, and capability to efficiently—
i: develop standards; and
ii: carry out an activity referred to in section 99(1)
2: Subsection (1)(a) does not apply to a person if—
a: they perform a function under another Act that involves recommending, developing, or making any secondary legislation; and
b: the chief executive considers that the function is relevant to the standards in respect of which they will act.
99: Approval may extend to other activities
1: The chief executive may, in the terms and conditions of an approval, provide for the approved person to also carry out 1 or more of the following activities:
a: performing or exercising under delegation a function or power under any of the following:
i: section 95(a)(ii) subpart 4
ii: section 95(a)(iv) subpart 7
iii: section 95(c) Guidance note
See clauses 2
b: giving advice on time frames for implementing standards:
c: providing services to promote the purpose of this Act or to assist the chief executive to perform any of the chief executive’s functions under section 95
2: Clause 2(5)(a) of Schedule 6 of the Public Service Act 2020 (Minister’s prior approval) does not apply to a delegation under subsection (1)(a). Guidance note
See section 103 See also section 135
100: How approval is given
1: The chief executive may approve a person by giving written notice to the person.
2: The notice must set out the terms and conditions of the approval, including the designation regulations in respect of which the appointment applies.
3: The chief executive must publish the notice—
a: in the Gazette
b: on an internet site maintained by or on behalf of the Ministry.
101: Chief executive may change terms and conditions or revoke approval at any time
1: The chief executive may, at any time and entirely at their discretion,—
a: change the terms and conditions of the approval; or
b: revoke the approval of a person under this subpart (wholly or for particular purposes).
2: The chief executive may make the change or revoke the approval by giving written notice to the person.
3: The chief executive must publish the notice—
a: in the Gazette
b: on an internet site maintained by or on behalf of the Ministry.
102: Subpart does not limit or affect chief executive’s powers
1: The approval of a person does not affect or prevent the performance of a function under section 95
2: In particular, the chief executive may make any decision on any standards that they think fit regardless of whether—
a: the decision is the same as, or different from, the advice or recommendation of an approved person; or
b: the approved person has been involved in the development of the standards.
3: This subpart does not limit the chief executive’s power to enter into any contract with any person or make any other arrangement for the purposes of performing the chief executive’s functions under section 95
103: Approved person must provide annual report on activities
1: An approved person must, within the time and in the manner specified by the chief executive,—
a: prepare an annual report on the following activities of the person during the 12-month period ending on the date of the report:
i: developing standards:
ii: carrying out any activities referred to in section 99(1)
b: give the annual report to the chief executive.
2: In addition to describing the approved person’s activities, the report may include recommendations for changes to this Act, the regulations, or standards that have been identified in the course of carrying out those activities.
3: The chief executive must publish each annual report that is received on an internet site maintained by or on behalf of the Ministry.
3: Designation regulations
104: Designation regulations
1: The Governor-General may, by Order in Council, on the recommendation of the Minister, make regulations that set out matters referred to in section 107 designation regulations
2: Regulations made under this section are secondary legislation ( see Part 3 Legislation Act 2019 The following table is small in size and has 3 columns that are grouped under the heading Legislation Act 2019 requirements for secondary legislation made under this section. Legislation Act 2019 requirements for secondary legislation made under this section Publication PCO must publish it on the legislation website and notify it in the Gazette LA19 s 69(1)(c) Presentation The Minister must present it to the House of Representatives LA19 s 114 Disallowance It may be disallowed by the House of Representatives LA19 ss 115 116 This note is not part of the Act.
105: Minister must have regard to certain matters when recommending designation regulations
1: Before recommending that designation regulations be made, the Minister must have regard to the following:
a: the interests of customers, including Māori customers:
b: any likely costs and benefits for the person or class of persons that are proposed to become data holders:
c: whether the regulations facilitate secure, standardised, and efficient regulated data services:
d: the likely benefits and risks associated with the proposed designation regulations in relation to—
i: the security, privacy, confidentiality, or other sensitivity of customer data and product data; and
ii: any intellectual property rights that may exist in relation to customer data or product data.
2: In this section, intellectual property rights
106: Minister must consult on proposed designation
1: Before recommending that designation regulations be made, the Minister must consult the following about the proposed designation:
a: the persons, or representatives of the persons, that the Minister considers will be substantially affected by the proposed designation regulations:
b: the Privacy Commissioner:
c: 1 or more people who have expert knowledge of te ao Māori approaches to data (for example, approaches to data access, use, or protection).
2: The Minister must decide which people to consult under subsection (1)(c) after taking into account the particular subject matter of the proposed designation regulations.
3: Subsection (1)(c) does not apply to regulations that amend other regulations if the Minister is satisfied that the amendments—
a: are only correcting minor errors; or
b: are otherwise of a minor or technical nature only.
4: A failure to comply with this section does not affect the validity of the designation regulations.
107: Contents of designation regulations
1: Designation regulations may set out all or any of the following: Designated persons: data holders
a: the persons or classes of persons (or both) being designated for the purposes of section 6 Designated data
b: the customer data or classes of customer data (or both) being designated as designated customer data for the purposes of 1 or more provisions of this Act:
c: the product data or classes of product data (or both) being designated as designated product data for the purposes of 1 or more provisions of this Act: Designated actions
d: the action or classes of action (or both) being designated as designated actions for the purposes of 1 or more provisions of this Act: Classes of accreditation
e: the classes of accreditation that may be granted in relation to the designation regulations: Secondary users
f: the persons or classes of persons (or both) being designated as secondary users (including specifying approval or other requirements or eligibility criteria to be met before a person may be a secondary user).
2: For the purposes of subsection (1)(a), the designation regulations may provide for a person to opt in to being designated for the purposes of section 6
3: Customer data or classes of customer data may be designated under subsection (1)(b) even if the data includes the personal information of any other person. Example
In this example, banks are designated for the purposes of section 6 The information includes a customer’s transactional information and information about a customer’s payees, which may include personal information about third parties. This information may be designated (and, accordingly, the bank will have a duty to provide it under section 14 15
4: For the purposes of subsection (1)(c), data or classes of data may be designated as designated product data only to the extent that they relate to any of the following:
a: a description of a product or any feature of the product:
b: any criteria for being eligible to acquire the product:
c: any terms or conditions for the supply of the product:
d: the price of the product:
e: any other data about the product that is of a kind that is ordinarily publicly available.
5: For the purposes of subsection (1)(e) and (f), a class of accreditation or a class of secondary user may be defined by reference to any 1 or more of the following:
a: data holders or any class of data holders:
b: customers or any class of customers:
c: designated customer data or any class of that data:
d: designated product data or any class of that data:
e: designated actions or any class of those actions:
f: any matters relating to the business, operation, or management of an accredited requestor or secondary user to which the class applies (for example, the services that an accredited requestor may provide to a customer):
g: limits or restrictions on the classes of—
i: requests that an accredited requestor may make:
ii: requests or authorisations (or both) that a secondary user may make or give:
h: any other circumstances in which—
i: an accredited requestor may make a request:
ii: a secondary user may make a request or give an authorisation.
6: See section 124 Example
Designation regulations may designate— banks for the purposes of section 6 the transaction histories and payees of a bank’s customers as classes of designated customer data: the home loan interest rates offered by a bank as a class of designated product data: making payments or opening a new account as classes of designated actions.
4: Accreditation of requestors
108: Application for accreditation
A person may apply to the chief executive to be accredited as an accredited requestor.
109: How application is made
The application must—
a: specify 1 or more designation regulations in relation to which the accreditation is requested; and
b: specify the classes of accreditation requested; and
c: specify the applicant’s New Zealand Business Number; and
d: contain the information specified by the regulations (if any); and
e: be accompanied by the fee prescribed by the regulations (if any); and
f: otherwise be made in the manner prescribed by the regulations (if any).
110: Application may be made before designation regulations fully in force
1: A person may apply for accreditation in relation to designation regulations before those regulations fully come into force.
2: For the purposes of dealing with the application, any provisions of the designation regulations that are relevant to the matter and that are not yet in force must be treated as if they were in force.
111: Chief executive must verify applicant’s identity
The chief executive must take reasonable steps to verify each applicant’s identity so that the chief executive is satisfied that they know who the applicant is.
112: Decision by chief executive
1: The chief executive must—
a: have regard to the matters specified in the regulations (if any) before making a decision; and
b: otherwise make the decision in the manner prescribed in the regulations (if any).
2: The chief executive may accredit an applicant if the chief executive is satisfied that—
a: the application meets the requirements of section 109
b: they know who the applicant is under section 111
c: the applicant has adequate security safeguards in relation to data that may be provided to them under this Act; and
d: the applicant is capable of effectively complying with its obligations under this Act and there is no reason to believe that the applicant is likely to contravene those obligations; and
e: the applicant meets the criteria or other requirements prescribed by the regulations (if any); and
f: the applicant’s directors, senior managers, proposed directors, and proposed senior managers are of good character and otherwise meet the criteria or other requirements prescribed by the regulations (if any); and
g: if section 49
3: The chief executive may grant the application—
a: in full or in part; and
b: on the terms and conditions that they think fit, including—
i: specifying the date of expiry of the accreditation; and
ii: specifying the class or classes of accreditation; and
iii: imposing conditions relating to the matters, criteria, and requirements referred to in subsection (1)(a) and (2)(c) to (g) (for example, to ensure that the criteria or requirements continue to be satisfied and to require verification that those criteria and requirements continue to be satisfied).
4: Those terms and conditions may be more limited or restrictive than those requested in the application (for example, more restrictive as to the classes of accreditation that are granted).
113: Notice of decision
1: The chief executive must give notice of their decision to the applicant.
2: If the chief executive declines the application (whether in full or in part) or imposes terms or conditions that are more limited or restrictive than those requested in the application, the chief executive must also set out their reasons for doing so.
3: If an application is successful (whether in full or in part), the chief executive must also give the applicant the following information:
a: the name of the designation regulations in relation to which the accreditation is granted:
b: the classes of accreditation granted.
114: Application to modify accreditation
1: An accredited requestor may apply to the chief executive to modify the terms or conditions of its accreditation, including to do 1 or more of the following:
a: add designation regulations in relation to which the accreditation is granted:
b: add 1 or more classes of accreditation:
c: remove designation regulations in relation to which the accreditation is granted:
d: remove 1 or more classes of accreditation.
2: After deciding the application, the chief executive must give the applicant the information specified in section 113(3)
3: Sections 109 113
115: Chief executive may modify terms or conditions on own motion
1: The chief executive may, on their own motion, modify the terms or conditions of the accreditation of an accredited requestor, including to do 1 or more of the following:
a: add designation regulations in relation to which the accreditation is granted:
b: add 1 or more classes of accreditation:
c: remove designation regulations in relation to which the accreditation is granted:
d: remove 1 or more classes of accreditation.
2: The chief executive must give notice of their decision to the accredited requestor.
3: In the case of subsection (1)(a) and (b), section 112
4: In the case of subsection (1)(c) and (d), the chief executive may make the modification if they are satisfied that—
a: any of the requirements referred to in section 112(2)(b) to (g)
b: the accredited requestor has materially contravened a term or condition of the accreditation or any other requirement imposed under this Act.
116: Duration of accreditation
1: An accredited requestor’s accreditation starts when the accreditation is registered and ends when the accreditation is removed from the register.
2: The chief executive must remove an accreditation from the register as soon as practicable after—
a: the accredited requestor tells the chief executive that it no longer wishes to remain accredited as an accredited requestor; or
b: the chief executive cancels the accreditation; or
c: the date of expiry of the accreditation (unless section 117(2)
d: the chief executive decides not to renew the accreditation on a renewal application referred to in section 117(2)
117: Renewal of accreditation
1: An accredited requestor may apply to renew its accreditation.
2: If a renewal application is made on or before the date of expiry of an accredited requestor’s accreditation, the accreditation continues to have effect until the renewal application is decided by the chief executive.
3: If the accredited requestor’s accreditation expires before a renewal application is made, instead of a renewal application, the accredited requestor must make a fresh application for accreditation under section 108
4: A renewal application must be made in the manner prescribed by the regulations (if any).
5: Sections 109 113
118: When chief executive may suspend or cancel accreditation
The chief executive may suspend (for a specified period or until a specified requirement is met) or cancel an accreditation if—
a: the accredited requestor, by written notice, requests the chief executive to do so; or
b: the chief executive is satisfied that any of the requirements referred to in section 112(2)(b) to (g)
c: the chief executive is satisfied that the accredited requestor is incapacitated, has ceased to exist, or has become subject to an insolvency event within the meaning of section 6(4)
d: the chief executive is satisfied that the accredited requestor has materially contravened a term or condition of the accreditation or any other requirement imposed under this Act.
5: Appeals
119: Appeals against accreditation decisions
A person may appeal to the High Court against a decision of the chief executive under subpart 4
a: decline to grant accreditation to a person; or
b: decline to renew a person’s accreditation; or
c: impose terms or conditions on a person’s accreditation; or
d: decline an application to modify a person’s accreditation; or
e: suspend or cancel a person’s accreditation.
6: Crown organisations
120: Crown organisations may be customer, data holder, or accredited requestor
1: For the purposes of this Act, an instrument of the Crown that is a Crown organisation (whether or not a body corporate)—
a: must be treated as if it were a separate legal personality for the purpose of complying with this Act; and
b: may be a customer, a data holder, or an accredited requestor in its own right.
2: For the purposes of this Act, an instrument of the Crown that is neither a Crown organisation nor a body corporate—
a: does not have separate legal personality; and
b: cannot be a customer, a data holder, or an accredited requestor in its own right.
3: In this section, Crown organisation section 4 2015 No 70 s 5
7: Register
121: Register of participants in customer and product data system
A register called the register of participants in the customer and product data system is established.
122: Purposes of register
The purposes of the register are to—
a: enable any person to—
i: confirm whether a person is a data holder or an accredited requestor; and
ii: obtain certain information about data holders and accredited requestors; and
b: enable data holders and accredited requestors to access certain information about each other; and
c: assist any person in the performance or exercise of the person’s functions, powers, or duties under this Act or any other legislation.
123: Operation of register
1: The chief executive must, in accordance with the regulations, keep the register as an electronic register.
2: The register must be operated at all times unless—
a: the chief executive suspends the operation of the register, in whole or in part, in accordance with subsection (3); or
b: otherwise provided in regulations.
3: The chief executive may refuse access to the register or otherwise suspend the operation of the register, in whole or in part, if the chief executive considers that it is not practicable to provide access to the register.
124: Persons that will become data holders when designation comes into force must provide information to chief executive
1: This section applies if—
a: designation regulations have been made but a provision under section 107(1)(a)
b: a person ( A
2: A must, in the manner prescribed by the regulations (if any), provide the following information to the chief executive at least 20 working days before the provision under section 107(1)(a)
a: A’s name and New Zealand Business Number:
b: a physical address for service in New Zealand for A:
c: the designation regulations in relation to which A is likely to be designated:
d: the identifying information and contact details for A that are prescribed by the regulations:
e: the information prescribed by the regulations to be included in the register under section 126
f: the information prescribed by the regulations to be included in the register under section 127
125: Other data holders must provide information to chief executive
1: This section applies to a person ( A section 124
2: A must, in the manner prescribed by the regulations (if any), provide the following information to the chief executive within 20 working days after it becomes aware that it has become a data holder:
a: A’s name and New Zealand Business Number:
b: a physical address for service in New Zealand for A:
c: the designation regulations in relation to which A is designated:
d: the identifying information and contact details for A that are prescribed by the regulations:
e: the information prescribed by the regulations to be included in the register under section 126
f: the information prescribed by the regulations to be included in the register under section 127
126: Contents of register that is publicly available
1: The register must contain—
a: the following information about each data holder ( A
i: A’s name and New Zealand Business Number:
ii: the designation regulations in relation to which A is designated:
iii: the classes of customer data and product data that A has to provide and the dates from which A must do so:
iv: the classes of action requests that A has to perform and the dates from which A must do so:
v: how customers may make a complaint about A’s conduct in connection with regulated data services that A provides:
vi: how customers may contact A about those services; and
b: the following information about each accredited requestor ( B
i: B’s name and New Zealand Business Number:
ii: the designation regulations in relation to which B is accredited:
iii: each class of accreditation held by B:
iv: how customers may make a complaint about B’s conduct in connection with regulated data services that B requests:
v: how customers may contact B about those services; and
c: the information prescribed for the purposes of this paragraph (if any).
2: The chief executive must ensure that the information referred to in this section is publicly available.
127: Contents of register that is available to data holders and accredited requestors (other than information publicly available under section 126)
1: The register must contain the information prescribed by the regulations for the purposes of this section.
2: The chief executive must ensure that the information prescribed by the regulations for the purposes of this section is reasonably available to data holders and accredited requestors.
8: Information sharing
128: Sharing of information with certain law enforcement or regulatory agencies
1: The chief executive may provide to a person or an agency specified in subsection (2) any information that the chief executive—
a: holds in relation to the performance or exercise of the chief executive’s functions, powers, or duties under this Act; and
b: considers may assist the person or agency to perform or exercise the person’s functions, powers, or duties under any legislation.
2: The persons or agencies are any of the following:
a: the Commerce Commission:
b: the Department of Internal Affairs:
c: the Ministry of Justice:
d: the Privacy Commissioner:
e: the Trust Framework Authority established under section 58
f: a person or an agency that is prescribed by the regulations for the purposes of this section.
3: The chief executive may use any information provided to it by any person or agency referred to in subsection (2) in the chief executive's performance or exercise of their functions, powers, or duties under this Act.
4: This section applies despite anything to the contrary in any contract, deed, or document.
5: This section does not limit any provision of this Act or any other legislation that allows the chief executive to use or disclose information.
129: Conditions that may be imposed on providing information under this subpart
1: The chief executive may impose any conditions in relation to providing information under this subpart.
2: The chief executive must, in considering what conditions to impose, have regard to whether conditions are necessary or desirable in order to protect the privacy of any individual.
3: The conditions may include, without limitation, conditions relating to—
a: maintaining the confidentiality of anything provided (in particular, information that is personal information within the meaning of the Privacy Act 2020
b: the storing of, the use of, or access to anything provided:
c: the copying, returning, or disposing of copies of documents provided:
d: payment of the costs incurred by the chief executive in providing any information under this subpart.
130: Restriction on publication, disclosure, or use
If information is provided to a person or an agency under this subpart, the person or agency may publish, disclose, or use the information only if the publication, disclosure, or use—
a: is authorised by the chief executive and is in accordance with any conditions imposed by the chief executive; or
b: is for the purposes of, or in connection with, the functions, powers, or duties of a person under any legislation.
9: Regulations, standards, and exemptions
Regulations
131: General regulations
1: The Governor-General may, by Order in Council, on the recommendation of the Minister, make regulations for all or any of the following purposes:
a: providing for anything that this Act says may or must be provided for by regulations:
b: prescribing, for the purposes of any provision of this Act that requires a thing to be done in a manner prescribed by the regulations (or standards), the manner in which the thing must be done, including prescribing—
i: by whom, when, where, and how the thing must be done:
ii: the form that must be used in connection with doing the thing:
iii: what information or other evidence or documents must be provided in connection with the thing:
iv: requirements with which information, evidence, or documents that are provided in connection with the thing must comply:
c: authorising the chief executive to determine or prescribe by notice any of the matters under paragraph (b):
d: prescribing matters for the purposes of section 58
e: prescribing procedures, requirements, and other matters, not inconsistent with this Act, for the register, including matters that relate to—
i: the operation of the register:
ii: the form of the register:
iii: the information to be contained in the register:
iv: access to the register:
v: search criteria for the register:
vi: circumstances in which amendments must be made to the register:
f: specifying requirements about how the standards may be made (for example, additional matters that the chief executive must have regard to):
g: if this Act says that anything may or must be provided for by regulations or standards, prescribing limits or restrictions on providing for that thing in standards ( see section 139
h: providing for anything incidental that is necessary for carrying out, or giving full effect to, this Act.
2: If the regulations under subsection (1)(d) require a data holder or an accredited requestor ( A section 58(3) B
a: the amount is to reimburse or compensate B for a cost or an expense that B has incurred as a result of a contravention of a duty imposed under this Act; and
b: the nature and extent of the cost or expense is readily ascertainable; and
c: there is a reasonably close connection between the contravention and the cost or expense that has been incurred.
3: Regulations made under this section are secondary legislation ( see Part 3 Legislation Act 2019
4: If regulations made under subsection (1)(c) authorise the chief executive to determine or prescribe matters by notice,—
a: a notice made under the regulations is secondary legislation ( see Part 3 Legislation Act 2019
b: the regulations must contain a statement to that effect. The following table is small in size and has 3 columns that are grouped under the heading Legislation Act 2019 requirements for secondary legislation referred to in subsection (3). Legislation Act 2019 requirements for secondary legislation referred to in subsection (3) Publication PCO must publish it on the legislation website and notify it in the Gazette LA19 s 69(1)(c) Presentation The Minister must present it to the House of Representatives LA19 s 114 Disallowance It may be disallowed by the House of Representatives LA19 ss 115 116 This note is not part of the Act. The following table is small in size and has 3 columns that are grouped under the heading Legislation Act 2019 requirements for secondary legislation referred to in subsection (4)(a). Legislation Act 2019 requirements for secondary legislation referred to in subsection (4)(a) Publication The maker must publish it in accordance with the Legislation (Publication) Regulations 2021 LA19 ss 69 73 74(1)(aa) Presentation The Minister must present it to the House of Representatives, unless it is excluded by section 114(2) LA19 s 114 Disallowance It may be disallowed by the House of Representatives, unless it is excluded by section 115 LA19 ss 115 116 This note is not part of the Act.
132: Minister must have regard to certain matters when recommending regulations under section 131
1: Before recommending that regulations be made under section 131
a: the interests of customers, including Māori customers:
b: any likely costs and benefits for data holders:
c: whether the regulations facilitate secure, standardised, and efficient regulated data services:
d: the likely benefits and risks associated with the proposed regulations in relation to the security, privacy, confidentiality, or other sensitivity of customer data and product data.
2: See also section 131(2) section 131(1)(d)
133: Regulations relating to fees and charges
1: The Governor-General may, by Order in Council, on the recommendation of the Minister, make regulations for all or any of the following purposes:
a: requiring the payment to the chief executive of fees and charges—
i: by any accredited requestor in connection with the performance or exercise by the chief executive of any function, power, or duty under this Act:
ii: on an application or a request from any person to the chief executive to perform or exercise any function, power, or duty under this Act:
b: prescribing the amounts of those fees and charges or the manner in which those fees and charges are to be calculated.
2: Regulations may authorise the chief executive to refund or waive, in whole or in part and on any conditions that may be prescribed, payment of the fee or charge in relation to any 1 or more named persons.
3: Regulations made under this section are secondary legislation ( see Part 3 The following table is small in size and has 3 columns that are grouped under the heading Legislation Act 2019 requirements for secondary legislation referred to in subsection (1). Legislation Act 2019 requirements for secondary legislation made under this section Publication PCO must publish it on the legislation website and notify it in the Gazette LA19 s 69(1)(c) Presentation The Minister must present it to the House of Representatives LA19 s 114 cl 32(1)(a) Disallowance It may be disallowed by the House of Representatives LA19 ss 115 116 This note is not part of the Act.
134: Miscellaneous provisions relating to fees and charges
1: The chief executive may refuse to perform a function or exercise a power until the prescribed fee or charge is paid.
2: Any fee or charge payable to the chief executive under this Act is recoverable by the chief executive in any court of competent jurisdiction as a debt due to the chief executive.
135: Levies payable by data holders and accredited requestors
1: Every person that is included in a prescribed class of specified persons must pay to the Crown, or a prescribed person on behalf of the Crown, a levy prescribed by the regulations.
2: In this section and section 136 specified person
a: a data holder; and
b: an accredited requestor.
3: The Governor-General may, by Order in Council, on the recommendation of the Minister, make regulations providing for the levies.
4: Levies must be prescribed on the basis that the following costs should be met fully out of the levies:
a: the whole or a portion of the costs of the chief executive in performing or exercising their functions, powers, and duties under this Act; and
b: the whole or a portion of the costs of the Privacy Commissioner in performing or exercising their functions, powers, and duties under the Privacy Act 2020 section 51(3) 52(1)
c: the whole or a portion of the costs of a person approved under subpart 2 section 99(1)
d: the whole or a portion of the costs of a person responsible for a dispute resolution scheme referred to in section 49 section 50(1)
e: the costs of collecting the levy money.
5: For the purpose of subsection (4)(a) to (d), the Minister must determine whether the whole or a portion of the costs will be met by levies under this Act (and the size of any portion).
6: Levies may be prescribed on the basis that any actual cost that could have been, but has not been, recovered as a levy shortfall for a year may be recovered (along with any financing charge) over any period of up to 5 years.
7: The regulations may—
a: specify the class or classes of specified persons that are required to pay a levy:
b: specify the amount of levies, or method of calculating or ascertaining the amount of levies:
c: include in levies, or provide for the inclusion in levies of, any shortfall in recovering the actual costs:
d: refund, or provide for refunds of, any over-recovery of the actual costs:
e: provide for the payment and collection of levies:
f: provide different levies for different classes of specified persons:
g: specify the financial year or part financial year to which a levy applies, and apply that levy to that financial year or part financial year and each subsequent financial year until the levy is revoked or replaced:
h: require payment of a levy for a financial year or part financial year, irrespective of the fact that the regulations may be made after that financial year has commenced:
i: authorise a person to whom a levy is payable to refund or waive, in whole or in part and on the conditions that may be prescribed, payment of the levy by 1 or more named persons.
8: Regulations made under this section are secondary legislation ( see Part 3 The following table is small in size and has 3 columns that are grouped under the heading Legislation Act 2019 requirements for secondary legislation made under this section. Legislation Act 2019 requirements for secondary legislation made under this section Publication PCO must publish it on the legislation website and notify it in the Gazette LA19 s 69(1)(c) Presentation The Minister must present it to the House of Representatives LA19 s 114 Disallowance It may be disallowed by the House of Representatives LA19 ss 115 116 This note is not part of the Act.
136: Miscellaneous provisions relating to levies
1: If a person is in 2 or more classes of specified persons in respect of which different levies have been prescribed under section 135
2: The amount of any unpaid levy is recoverable in any court of competent jurisdiction as a debt due to the chief executive, or to any other person prescribed for the purposes of this subsection, on behalf of the Crown.
3: The chief executive, or any other person prescribed for the purposes of this subsection, must ensure that each levy payment is paid into a Crown Bank Account and is separately accounted for.
137: Minister must consult on proposed regulations
1: Before recommending that regulations be made under this subpart, the Minister must consult the following about the proposed regulations:
a: the persons, or representatives of the persons, that the Minister considers will be substantially affected by the proposed regulations:
b: the Privacy Commissioner:
c: 1 or more people who have expert knowledge of te ao Māori approaches to data (for example, approaches to data access, use, or protection).
2: The Minister must decide which people to consult under subsection (1)(c) after taking into account the particular subject matter of the proposed regulations.
3: Subsection (1)(c) does not apply to regulations made under section 135
4: Subsection (1)(c) does not apply to regulations that amend other regulations if the Minister is satisfied that—
a: the amendments are only correcting minor errors; or
b: the amendments are otherwise of a minor or technical nature only; or
c: it is necessary or desirable in the public interest that the amendments be made urgently.
5: This section does not apply to regulations made under section 131(1)(c) or (f)
6: A failure to comply with this section does not affect the validity of the regulations. Standards
138: Standards
1: The chief executive may make 1 or more standards—
a: providing for anything that this Act says must or may be provided for by the standards; and
b: prescribing, for the purposes of any provision of this Act that requires a thing to be done in a manner prescribed by the standards (or regulations), the manner in which the thing must be done, including prescribing—
i: by whom, when, where, and how the thing must be done:
ii: the form that must be used in connection with doing the thing:
iii: what information or other evidence or documents must be provided in connection with the thing:
iv: requirements with which information, evidence, or documents that are provided in connection with the thing must comply.
2: If the standards are inconsistent with the regulations, the regulations prevail to the extent of the inconsistency.
3: Standards made under this section are secondary legislation ( see Part 3 Legislation Act 2019 The following table is small in size and has 3 columns that are grouped under the heading Legislation Act 2019 requirements for secondary legislation made under this section. Legislation Act 2019 requirements for secondary legislation made under this section Publication The maker must publish it in accordance with the Legislation (Publication) Regulations 2021 LA19 s 74(1)(aa) Presentation The Minister must present it to the House of Representatives LA19 s 114 Disallowance It may be disallowed by the House of Representatives LA19 ss 115 116 This note is not part of the Act.
139: Chief executive must comply with requirements before making standard
Before making a standard, the chief executive must—
a: comply with any requirements prescribed by the regulations under section 131(1)(f)
b: be satisfied that the standards are consistent with any limits or restrictions prescribed by the regulations ( see section 131(1)(g)
c: have regard to the following:
i: the interests of customers, including Māori customers:
ii: any likely costs and benefits for data holders:
iii: whether the standards facilitate secure, standardised, and efficient regulated data services:
iv: whether the standards support consistency and interoperability (where relevant) across designated areas:
v: the likely benefits and risks associated with the proposed standards in relation to the security, privacy, confidentiality, or other sensitivity of customer data and product data.
140: Chief executive’s consultation on proposed standards
1: Before making a standard, the chief executive must consult the following:
a: the persons, or representatives of the persons, that the chief executive considers will be substantially affected by the issue of the proposed standard:
b: the Privacy Commissioner:
c: 1 or more people who have expert knowledge of te ao Māori approaches to data (for example, approaches to data access, use, or protection).
2: The chief executive must decide which people to consult under subsection (1)(c) after taking into account the particular subject matter of the proposed standards.
3: Subsection (1)(c) does not apply to a standard that amends another standard if the chief executive is satisfied that—
a: the amendment is only correcting a minor error; or
b: the amendment is otherwise of a minor or technical nature only; or
c: it is necessary or desirable in the public interest that the amendment be made urgently.
4: If the chief executive relies on subsection (3)(c), the chief executive must publish a statement of their reasons for acting under that paragraph.
5: A failure to comply with this section does not affect the validity of the standards. Exemptions
141: Exemptions
1: The Governor-General may, by Order in Council, made on the recommendation of the Minister, make regulations exempting (on terms and conditions, if any) classes of persons from any requirement under this Act.
2: Before making a recommendation, the Minister must—
a: have regard to the purpose of this Act as specified in section 3
b: be satisfied that the extent of the exemption is not broader than is reasonably necessary to address the matters that gave rise to the regulations.
3: The Minister’s reasons for making the recommendation (including why an exemption is appropriate) must be published together with the regulations.
4: Regulations made under this section are secondary legislation ( see Part 3 Legislation Act 2019 The following table is small in size and has 3 columns that are grouped under the heading Legislation Act 2019 requirements for secondary legislation made under this section. Legislation Act 2019 requirements for secondary legislation made under this section Publication PCO must publish it on the legislation website and notify it in the Gazette LA19 s 69(1)(c) Presentation The Minister must present it to the House of Representatives LA19 s 114 Disallowance It may be disallowed by the House of Representatives LA19 ss 115 116 This note is not part of the Act.
142: Effect of breach of term or condition of exemption
A breach of a term or condition of an exemption granted under this subpart is a breach of the obligation for which the exemption applies (unless the terms of the exemption otherwise provide).
10: Miscellaneous
143: No contracting out
1: This Act has effect despite any provision to the contrary in any agreement (regardless of when the agreement is entered into).
2: A data holder that purports to contract out of any provision of this Act commits an offence against section 13(i) Example
A data holder enters into a contract with a customer. Under the contract, the data holder purports to contract out of its duty to provide data to the customer under section 14 The data holder commits an offence.
144: Chief executive’s warnings, reports, guidelines, or comments protected by qualified privilege
For the purposes of clause 3
145: Notices
1: A notice served by the chief executive for the purposes of section 29 53
a: in writing; and
b: served in accordance with section 146
2: All documents purporting to be signed by or on behalf of the chief executive must, in all courts and in all proceedings under this Act, be treated as having been so signed with due authority unless the contrary is proved. 2011 No 5 s 62
146: Service of notices
1: A notice required or authorised to be served on any person for the purposes of section 29 53
a: be served on an individual—
i: by delivering it personally or by an agent (such as a courier) to the person; or
ii: by sending it by post addressed to the person at the person's usual or last known place of residence or business; or
iii: by sending it by email to the person's email address provided by the person for the purpose; or
iv: in any other manner a District Court Judge directs:
b: be served on a company, within the meaning of the Companies Act 1993 section 388
c: be served on an overseas company in a manner provided for in section 390
d: be served on any other body corporate in a manner in which it could be served if the body corporate were a company within the meaning of the Companies Act 1993
2: In the absence of proof to the contrary, a notice sent to a person in accordance with—
a: subsection (1)(a)(ii) must be treated as having been served on the person when it would have been delivered in the ordinary course of post; and, in proving the delivery, it is sufficient to prove that the notice was properly addressed and posted:
b: subsection (1)(a)(iii) must be treated as having been served on the person on the second working day after the day on which it is sent.
3: Section 392
4: If a person is absent from New Zealand, a notice served on the person's agent in New Zealand in accordance with subsection (1) must be treated as having been served on the person.
5: If a person has died, the notice may be served, in accordance with subsection (1), on their personal representative. 2011 No 5 s 63
11: Consequential amendments
Amendment to Disputes Tribunal Act 1988
147: Principal Act
Section 148 Disputes Tribunal Act 1988 2025-03-30 Disputes Tribunal Act 1988
148: Schedule 1 amended
In Schedule 1 Customer and Product Data Act 2025 Amendments to Privacy Act 2020
149: Principal Act
Sections 150 151 Privacy Act 2020 2025-03-30 Privacy Act 2020
150: Section 75 amended (Referral of complaint to another person)
After section 75(1)(d)
e: the chief executive within the meaning of section 5 of the Customer and Product Data Act 2025.
151: Section 208 amended (Consultation)
After section 208(1)(d)
e: the chief executive within the meaning of section 5 Amendment to Summary Proceedings Act 1957
152: Principal Act
Section 153 Summary Proceedings Act 1957 2025-03-30 Summary Proceedings Act 1957
153: Section 2 amended (Interpretation)
In section 2(1) infringement notice
bb: section 63