Why Is the Privacy Act Important?

The Privacy Act is important because people should have some control over their personal information
For example, when someone creates an account on a website, the company might ask for their:
Name
Email address
Phone number*
Address
Date of birth*
Payment information.
The organisation should have a good reason for collecting this information and should explain how it will be used.
The Act also helps people to -
Know when their information is being collected
* Understand why their information is needed
* Access information held about them
* Ask for incorrect information to be corrected
* Have their information protected from misuse
* Expect their information to be handled appropriately

Principle 1 – Purpose of Collection

Organisations should only collect personal information when they have a genuine and lawful reason for needing it.For example, an online store may need a customer’s name and delivery address to send an order. However, it should not collect extra personal information if it is not needed. This means organisations should think carefully about what information they really need before collecting it.

Principle 2 – Source of Information

Personal information should normally be collected directly from the person it is about. For example, if a company needs your phone number, it will normally ask you directly instead of getting it from another person. There are some situations where information can legally be collected from another source, such as when the person has given permission or the information is publicly available.

Principle 3 – Being Open About Collection

when an organisation collects information directly from someone, it should explain what information it is collecting and why it needs it.For example, when signing up for a website, a privacy notice might explain:
What information is being collected*
Why it is needed*
How it will be used*
Who may receive it
What rights the person has
This helps people make an informed decision about providing their information.⸻
Principle 3A – Information Collected From
Another SourcePrinciple 3A is a newer requirement that came into force on 1 May 2026. It applies when an organisation collects personal information about someone from another source rather than directly from that person. In these situations, the organisation generally needs to take reasonable steps to make the person aware that their information was collected.They may need to explain:* That their information was collected* Why it was collected* Who may receive it* Which organisation collected it* Which organisation is holding it* Their rights to access and correct the information There are exceptions to this requirement in some situations.

Privacy and IT

The Privacy Act is closely connected to the IT industry.IT professionals may work with:* Websites* Customer databases* Employee records* Cloud storage* Mobile applications* Online accounts* Payment systems* Email systems* Health information Because of this, privacy should be considered when a system is being designed, not only after a privacy problem occurs. For example, when creating a registration form, a developer should ask: “Do we really need all this information?” If the answer is no, the information should not be collected unnecessarily.
IT professionals should also make sure that databases are secure and that only authorised people can access private information.

Māori Data Sovereignty

Privacy can also be understood from a Māori perspective.Māori data sovereignty is about Māori rights and interests in relation to Māori data. It recognises that data can have importance not only to individual people but also to whānau, hapū, iwi and Māori communities.Māori data can include information about:
* Māori people
* Whakapapa
* Te reo Māori
* Māori culture
* Māori communities
* Māori resources and environments
* Mātauranga MāoriTe Mana Raraunga describes Māori data as information or knowledge about or from Māori people, language, culture, resources and environments. It also promotes Māori governance over Māori data. This means that organisations should think carefully about how Māori data is collected, stored, accessed and shared.

Te Mana Raraunga

Te Mana Raraunga is the Māori Data Sovereignty Network.It promotes Māori rights and interests in data and supports the safe and ethical use of data for Māori people, language and culture.
It also supports Māori governance over Māori data.
Some of the principles connected with Māori data sovereignty include
- Rangatiratanga – authority and control* Whakapapa – relationships* Whanaungatanga – relationships and responsibilities* Kotahitanga – collective benefit
* Manaakitanga – care and reciprocity
* Kaitiakitanga – guardianship These ideas show that protecting data can be about more than passwords and computer security. It can also involve relationships, culture, responsibility and who has authority over information.
The Office of the Privacy Commissioner also recognises that tikanga Māori and te ao Māori perspectives can be important when considering privacy and sensitive personal information.

Refernce-

Office of the Privacy Commissioner. (2026). Privacy Act 2020. Office of the Privacy Commissioner – Privacy Act 2020⁠,
Te Mana Raraunga. (n.d.). Māori Data Sovereignty Network. Te Mana Raraunga