Under the NZ Privacy Act 2020, businesses using AI tools must ensure personal data is collected for a clear purpose, stored securely, not sent to overseas providers without adequate protections, and accessible to individuals on request. Most NZ businesses using tools like ChatGPT, Zapier, or cloud CRMs have compliance obligations they're not fully aware of.

Key Takeaways

• The Privacy Act 2020 applies to any business collecting or processing personal data — including via AI tools

• Sending NZ customer data to overseas AI providers has specific compliance requirements

• Individuals can request to see or delete the data you hold about them

• Non-compliance can result in fines and orders from the Privacy Commissioner

What the Privacy Act 2020 says about data

The Privacy Act 2020 replaced the 1993 Act with stronger obligations. The 13 Information Privacy Principles (IPPs) govern how personal information must be collected, used, stored, and shared.

The most relevant principles for businesses using AI:

IPP 1 — Purpose of collection: Only collect personal data for a lawful purpose directly related to your business. Tell people why you're collecting their data.

IPP 5 — Storage and security: Take reasonable steps to protect personal information from loss, misuse, or unauthorised access.

IPP 10 and 11 — Limits on use and disclosure: Don't use or share personal data for purposes other than why it was collected. This directly affects sending data to overseas AI tools.

IPP 12 — Right of access: Individuals have the right to request what personal data you hold about them — and to have it corrected or deleted.

The AI-specific questions every NZ business should ask

1. Where does your data go when you use AI tools?

When you paste a customer's email into ChatGPT, or process invoices through a cloud AI tool, that data may be sent to servers in the US or EU.

Under IPP 11, you must take reasonable steps to ensure overseas recipients protect that data at a standard comparable to NZ law. US-based AI companies (OpenAI, Google) have privacy policies — but their default data handling may not meet NZ Privacy Act standards.

What to do:

• Check whether your AI tools store or train on your data (OpenAI's API does not use your data for training by default; the consumer ChatGPT interface does unless you opt out in settings)

• Use business or enterprise versions of AI tools where available — they typically have stronger data protections and data processing agreements

• Consider NZ-hosted or AU-hosted alternatives where data residency matters

2. Are you collecting data through AI-powered forms or chatbots?

If your website has a chatbot that collects customer information (name, email, enquiry details), you must:

• Display a privacy notice explaining what data is collected and why

• Not collect more data than you need

• Store it securely

• Have a process for responding to deletion requests

3. Does your AI make decisions about customers?

AI tools that score leads, flag customers, or prioritise service may be making automated decisions about individuals. Significant decisions affecting people should not be made purely by automated means without human oversight.

4. Do your staff know what's compliant?

The biggest privacy risk for most NZ SMEs isn't the technology — it's staff pasting sensitive customer data into consumer AI tools without understanding the implications. A simple internal policy covering which data can be used with which tools goes a long way.

What compliant AI automation looks like

Do:

• Use AI tools via API (not consumer interfaces) where data training is off by default

• Choose tools that offer data processing agreements (DPAs)

• Keep personal data in NZ or Australian-region servers where possible

• Document what data your automations collect and why

• Have a process for responding to access and deletion requests

Don't:

• Paste customer personal data into consumer ChatGPT without checking settings

• Assume overseas AI tools are automatically compliant with NZ law

• Ignore privacy notices if you're collecting data via AI tools or chatbots

Is this complicated?

For most NZ SMEs, the practical steps are straightforward:

1. Know what personal data your AI tools handle

2. Check where it's stored and whether it's used for training

3. Add a privacy notice to your website if you're collecting data

4. Have a simple process for data access and deletion requests

5. Brief your team on what's acceptable to put into AI tools

Cherry AI builds automations that are compliant with NZ Privacy Act obligations by design. All our solutions use API-based integrations with data processing agreements, and we can advise on data residency requirements for your specific use case.