Data Processing Agreement (New Zealand)
This Data Processing Agreement (the “Agreement”) is entered into on [Effective Date] (the “Effective Date”) between:
[Controller Name], NZBN [Controller NZBN], of [Controller Address], [Controller City], [Controller Region] [Controller Postcode], New Zealand (the “Controller”); and
[Processor Name], NZBN [Processor NZBN], of [Processor Address], [Processor City], [Processor Region] [Processor Postcode], New Zealand (the “Processor”).
The Controller and the Processor are referred to collectively as the “Parties” and individually as a “Party”.
BACKGROUND
The Controller engages the Processor to process personal information on its behalf in connection with services provided under a separate agreement between the Parties (the “Underlying Agreement”). This Agreement sets out the obligations of the Processor with respect to that processing, in compliance with the Privacy Act 2020 of New Zealand and the Information Privacy Principles (IPPs) set out in that Act.
1. DEFINITIONS
1.1 In this Agreement: “Personal Information” has the meaning given to it in the Privacy Act 2020, namely information about an identifiable individual. “Processing” means any operation performed on personal information, including collection, storage, use, disclosure, and deletion. “Notifiable Privacy Breach” has the meaning given to it in the Privacy Act 2020. “Privacy Commissioner” means the Privacy Commissioner appointed under the Privacy Act 2020. “IPP” means an Information Privacy Principle set out in Schedule 1 of the Privacy Act 2020.
2. PROCESSING INSTRUCTIONS
2.1 The Processor shall process Personal Information only on the documented instructions of the Controller, and for no other purpose, except as required by applicable New Zealand law.
2.2 The purpose of processing under this Agreement is: [Processing Purpose].
2.3 The categories of Personal Information to be processed are: [Personal Information Categories].
2.4 The categories of data subjects whose Personal Information will be processed are: [Data Subjects].
2.5 The Processor shall promptly inform the Controller if it believes a processing instruction infringes the Privacy Act 2020 or any other applicable New Zealand law.
3. PROCESSOR OBLIGATIONS AND PRIVACY ACT 2020 COMPLIANCE
3.1 The Processor shall comply with all applicable obligations under the Privacy Act 2020 and the IPPs with respect to the Personal Information it processes on behalf of the Controller, including:
IPP 5 (Storage and Security): The Processor shall protect Personal Information against unauthorised access, use, modification, disclosure, and other misuse by implementing appropriate technical and organisational security measures, including: [Security Measures].
IPP 10 (Use of Personal Information): The Processor shall not use Personal Information for any purpose other than the purposes specified in clause 2.2 of this Agreement.
IPP 11 (Limits on Disclosure): The Processor shall not disclose Personal Information to any person except as necessary to perform the services under the Underlying Agreement or as required by law.
3.2 The Processor shall ensure that all personnel who access Personal Information are subject to appropriate confidentiality obligations and have received training on their obligations under the Privacy Act 2020.
3.3 The Processor shall assist the Controller in responding to access requests and correction requests made by data subjects under the Privacy Act 2020 (IPP 6 and IPP 7).
5. PRIVACY BREACH NOTIFICATION
5.1 In the event of a suspected or confirmed privacy breach involving Personal Information processed under this Agreement, the Processor shall notify the Controller [Breach Notification Period].
5.2 The Processor’s notification to the Controller shall include, to the extent available: (a) a description of the nature of the breach; (b) the categories and approximate number of data subjects affected; (c) the categories and approximate quantity of Personal Information records affected; (d) the likely consequences of the breach; and (e) the measures taken or proposed by the Processor to address the breach and mitigate its effects.
5.3 The Processor shall cooperate fully with the Controller in any investigation or notification process required under the Privacy Act 2020, including any notification to the Privacy Commissioner or affected individuals.
6. SUB-PROCESSORS
6.1 The Processor shall not engage a sub-processor to process Personal Information under this Agreement without the prior written consent of the Controller.
6.2 Where the Controller consents to the engagement of a sub-processor, the Processor shall ensure that the sub-processor is bound by data processing obligations no less protective than those in this Agreement.
6.3 The Processor remains fully liable to the Controller for the performance of sub-processors’ obligations under this Agreement.
7. AUDIT AND COMPLIANCE
7.1 The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with its obligations under this Agreement and the Privacy Act 2020.
7.2 The Controller or its nominated auditor may, upon reasonable notice, conduct audits of the Processor’s data processing practices and security measures. The Processor shall cooperate fully with such audits.
7.3 The Processor shall notify the Controller’s Privacy Officer, [Controller Privacy Officer], of any inquiry, investigation, or complaint from the Privacy Commissioner or any other regulatory authority relating to the processing of Personal Information under this Agreement.
8. TERM AND TERMINATION
8.1 This Agreement shall remain in force [Agreement Term].
8.2 Upon expiry or termination of this Agreement, the Processor shall, at the Controller’s written election, either return all Personal Information to the Controller or permanently and securely destroy it, and provide written confirmation of such destruction to the Controller.
8.3 The Processor may retain copies of Personal Information to the extent required by applicable New Zealand law or regulation, provided that such retained Personal Information remains subject to the obligations of this Agreement.
9. GENERAL PROVISIONS
9.1 Conflict. In the event of any conflict between this Agreement and the Underlying Agreement with respect to the processing of Personal Information, this Agreement shall prevail.
9.2 Governing Law and Jurisdiction. This Agreement is governed by the laws of New Zealand, including the Privacy Act 2020 and the Contract and Commercial Law Act 2017. The Parties submit to the non-exclusive jurisdiction of the courts of New Zealand, including the High Court sitting at [Governing Region].
9.3 Amendments. No amendment to this Agreement is effective unless made in writing and signed by authorised representatives of both Parties.
9.4 Severability. If any provision of this Agreement is invalid or unenforceable, the remaining provisions continue in full force and effect.
IN WITNESS WHEREOF, the Parties have executed this Data Processing Agreement as of the Effective Date.
THE CONTROLLER
Name: [Controller Name]
Address: [Controller Address], [Controller City], [Controller Region] [Controller Postcode], New Zealand
THE PROCESSOR
Name: [Processor Name]
Address: [Processor Address], [Processor City], [Processor Region] [Processor Postcode], New Zealand
Controller
________________
Signature
Date: ________________
Processor
________________
Signature
Date: ________________
What Is a Data Processing Agreement (New Zealand)?
A Data Processing Agreement in New Zealand records the personal-data processing to be provided, the fees, the service standards, and each party's obligations between the provider and the client under the Privacy Act 2020.
The Privacy Act 2020, which replaced the Privacy Act 1993 and came into force on 1 December 2020, is the primary legislation governing the handling of personal information in New Zealand. The Act applies to all agencies that collect, store, use, or disclose personal information about identifiable individuals in the course of their activities in New Zealand. The 13 Information Privacy Principles (IPPs) set out in Schedule 1 of the Privacy Act 2020 establish the baseline obligations for how personal information must be handled.
When an organisation engages a service provider to process personal information on its behalf — for example, a payroll provider, a cloud storage service, a marketing automation platform, or a software developer — the organisation remains responsible for confirming that the service provider handles the personal information in accordance with the Privacy Act 2020. A Data Processing Agreement formalises this arrangement by placing binding contractual obligations on the Processor and confirming that the Controller can demonstrate compliance with the Act.
The Privacy Act 2020 introduced several significant changes compared to its predecessor, including mandatory privacy breach reporting under sections 112 to 121. Under these provisions, an agency must notify both the Privacy Commissioner and affected individuals when a privacy breach has caused, or is likely to cause, serious harm to an affected individual. This obligation applies regardless of whether the breach was caused by the agency itself or by a Processor acting on its behalf, which makes it essential for Controllers to have clear contractual arrangements with their Processors regarding breach detection, reporting, and response.
New Zealand organisations that have international operations or that use overseas service providers must also be aware of IPP 12, which restricts the cross-border disclosure of personal information. Under IPP 12, an agency must not disclose personal information to an overseas recipient unless the agency has taken reasonable steps to confirm that the recipient will handle the information in a way that provides comparable protections to those under New Zealand law. A Data Processing Agreement that addresses cross-border transfers and includes appropriate safeguards helps the Controller satisfy this requirement.
New Zealand’s digital economy is highly integrated with global technology platforms, and many New Zealand organisations use cloud-based services hosted in overseas jurisdictions such as the United States, Australia, and Singapore. A well-drafted Data Processing Agreement is essential for any New Zealand organisation that uses overseas cloud service providers to process personal information about New Zealand individuals, as it provides the contractual framework for demonstrating IPP 12 compliance.
The Privacy Commissioner has published guidance on data processing and the use of cloud services, recommending that organisations enter into written agreements with processors that address the requirements of the Privacy Act 2020. Organisations that fail to have appropriate DPAs in place may face complaints and investigations by the Privacy Commissioner, as well as potential civil liability under the Human Rights Review Tribunal.
When Do You Need a Data Processing Agreement (New Zealand)?
A Data Processing Agreement is required whenever a New Zealand organisation engages a third party to process personal information on its behalf. The scope of this obligation is broad and covers a wide range of common business activities.
Cloud computing and SaaS (Software as a Service) engagements are among the most common scenarios requiring a DPA in New Zealand. When an organisation stores customer data, employee records, or financial information in a cloud platform such as Microsoft Azure, Amazon Web Services, Google Cloud, or a New Zealand-hosted equivalent, it is disclosing personal information to the cloud provider for processing. A DPA confirms that the cloud provider is subject to binding obligations under the Privacy Act 2020 and that the Controller can audit and monitor compliance.
Payroll processing is another area where a DPA is essential. Payroll service providers in New Zealand handle highly sensitive personal information, including employees’ IRD numbers, bank account details, salary and wage information, and KiwiSaver contribution rates. A DPA confirms that the payroll provider handles this information only as instructed by the employer, implements appropriate security measures, and notifies the employer promptly in the event of a breach.
Marketing and analytics services frequently involve the processing of personal information about customers and prospects. When a business uses a third-party email marketing platform, a CRM system, a web analytics tool, or a customer data platform (CDP), it is disclosing personal information to those providers for processing. Under IPP 10 of the Privacy Act 2020, personal information must not be used for a purpose other than the one for which it was collected. A DPA confirms that marketing technology providers do not use the Controller’s customer data for their own purposes.
Healthcare organisations in New Zealand face particularly stringent obligations when engaging third parties to process health information, which is a category of sensitive personal information. The Health Information Privacy Code 2020 supplements the Privacy Act 2020 with specific rules for health information. Any health sector organisation engaging IT providers, cloud services, or medical records management companies must have a DPA that addresses the requirements of both the Privacy Act 2020 and the Health Information Privacy Code.
Financial services providers regulated by the Financial Markets Authority (FMA) and the Reserve Bank of New Zealand (RBNZ) are subject to additional data governance requirements. When these organisations engage third-party data processors, the DPA must address not only the Privacy Act 2020 but also any applicable prudential standards and conduct obligations under the Financial Markets Conduct Act 2013.
Educational institutions in New Zealand, including schools, polytechnics, and universities, frequently use third-party learning management systems, student information systems, and cloud-based collaboration tools. A DPA is essential for managing the privacy obligations associated with processing student and staff personal information. The Ministry of Education and the New Zealand Qualifications Authority (NZQA) have specific expectations regarding the privacy practices of educational institutions, and a DPA demonstrates the institution’s commitment to compliance.
New Zealand government agencies procuring digital services from private sector providers must confirm that any processing of personal information by those providers is subject to appropriate contractual arrangements. The Government Chief Privacy Officer (GCPO) and the Privacy Commissioner provide guidance on procurement practices for government agencies, and a DPA is a standard requirement for any government technology procurement involving personal information.
What to Include in Your Data Processing Agreement (New Zealand)
A thorough Data Processing Agreement for use in New Zealand should contain the following key provisions.
The processing instructions clause is the foundation of the DPA. It must precisely define the purposes for which the Processor may process personal information, the categories of personal information to be processed, and the categories of data subjects whose information will be handled. The Processor must be prohibited from processing personal information for any purpose beyond those specified. This clause directly implements IPP 10 (limits on use) and confirms that the Processor acts only as instructed by the Controller.
The security measures clause sets out the technical and organisational measures the Processor must implement to protect personal information against unauthorised access, use, modification, disclosure, or destruction. This clause implements IPP 5 of the Privacy Act 2020 and should be specific rather than generic. It should address encryption standards (for data at rest and in transit), access control mechanisms, multi-factor authentication, physical security of data centres, backup procedures, penetration testing frequency, and staff training.
The cross-border disclosure clause must address the requirements of IPP 12 where personal information will be transferred outside New Zealand. It should identify the specific countries to which personal information may be disclosed, the basis for satisfying IPP 12 in each case (such as comparable overseas law, contractual protections, or individual consent), and the Controller’s right to be notified of any change to the countries involved.
The privacy breach notification clause sets out the Processor’s obligation to notify the Controller promptly upon becoming aware of a suspected or confirmed privacy breach. The Privacy Act 2020 requires organisations to assess whether a breach is notifiable and to report it to the Privacy Commissioner within a reasonable time. The DPA should specify the notification timeframe (typically 24 to 48 hours for suspected breaches), the minimum content of the notification, and the Processor’s obligation to cooperate in the investigation and remediation of the breach.
The sub-processor clause controls the Processor’s right to engage sub-processors. It should require the Controller’s prior written consent before any sub-processor is engaged, impose an obligation on the Processor to confirm that sub-processors are bound by equivalent obligations, and confirm that the Processor remains liable for sub-processor acts and omissions.
The audit and compliance clause gives the Controller the right to verify that the Processor is complying with its obligations under the DPA. It should specify the notice required before an audit, the scope of the audit rights, and the obligation of the Processor to provide all necessary information and access.
The data return and destruction clause addresses what happens to personal information at the end of the engagement. Upon expiry or termination of the DPA, the Processor should be required to return all personal information to the Controller (in a usable format) or to permanently and securely destroy it, with written confirmation.
The term and termination clause should tie the duration of the DPA to the duration of the underlying services agreement and specify how long data retention obligations survive termination. The governing law clause must confirm that the DPA is governed by New Zealand law, including the Privacy Act 2020 and the Contract and Commercial Law Act 2017, and specify the New Zealand courts as the forum for disputes. The forms-legal.com Data Processing Agreement (New Zealand) provides a ready-to-use template that meets New Zealand legal requirements.
Cite this page
Reference this free template in an article, syllabus, or research note:
Forms Legal. (2026). Data Processing Agreement (New Zealand) (New Zealand) [Legal document template]. Forms Legal. https://forms-legal.com/new-zealand/business/intellectual-property/data-processing-agreement-new-zealand
"Data Processing Agreement (New Zealand) (New Zealand)." Forms Legal, 2026, https://forms-legal.com/new-zealand/business/intellectual-property/data-processing-agreement-new-zealand.
@misc{formslegal-data-processing-agreement-new-zealand,
author = {{Forms Legal}},
title = {Data Processing Agreement (New Zealand) (New Zealand)},
year = {2026},
howpublished = {\url{https://forms-legal.com/new-zealand/business/intellectual-property/data-processing-agreement-new-zealand}},
note = {Free legal document template. Based on Privacy Act 2020}
}Also available for these jurisdictions:
Frequently Asked Questions
While the Privacy Act 2020 does not prescribe a mandatory Data Processing Agreement in the same way as the GDPR, it does impose obligations on organisations that disclose personal information to third parties for processing on their behalf. Under IPP 11 of the Privacy Act 2020, an agency must not disclose personal information unless the disclosure is authorised and the agency has taken reasonable steps to requires the information will be protected. Entering into a formal Data Processing Agreement is the most effective way to demonstrate that the Controller has taken those reasonable steps. The Privacy Commissioner has indicated that written contractual arrangements with processors are considered established standards for organisations subject to the Privacy Act 2020. For organisations that also deal with overseas regulators (such as the EU GDPR or the Australian Privacy Act), a DPA aligned with New Zealand requirements helps demonstrate compliance across multiple jurisdictions.
IPP 12 of the Privacy Act 2020 restricts the disclosure of personal information to recipients located outside New Zealand. Before making such a disclosure, the disclosing agency must take reasonable steps to require that the overseas recipient will handle the information in a way that, overall, provides comparable safeguards to those under New Zealand law. The Privacy Act 2020 provides several mechanisms for satisfying this requirement. These include: the overseas recipient being subject to a law that provides comparable privacy protections (such as Australia’s Privacy Act 1988 or the GDPR); the individual concerned expressly consenting to the overseas disclosure; or the disclosure being necessary to perform a contract with the individual. Where no such mechanism is available, the Controller may need to rely on contractual clauses or binding corporate rules. The Data Processing Agreement should specifically address IPP 12 compliance and identify the countries to which personal information may be transferred and the safeguards in place.
The Privacy Act 2020 introduced mandatory privacy breach notification in New Zealand, which came into force on 1 December 2020. Under section 113 of the Privacy Act 2020, an agency must notify the Privacy Commissioner and affected individuals if it experiences a privacy breach that has caused, or is likely to cause, serious harm. A Processor that experiences a breach involving personal information processed on behalf of a Controller must act quickly. Under a well-drafted Data Processing Agreement, the Processor is required to notify the Controller within a specified period (typically 24 to 72 hours) of becoming aware of a suspected or confirmed breach. The Controller is then responsible for assessing whether the breach is notifiable under the Privacy Act 2020 and for making the required notifications. The Processor must cooperate fully with the Controller’s investigation and provide all available information about the nature, scope, and cause of the breach.
Yes, but only subject to the Controller’s prior written consent. A Processor that engages a sub-processor to handle personal information without the Controller’s authorisation may be in breach of IPP 11 (which limits disclosure) and may also breach the contractual terms of the Data Processing Agreement. Where the Controller does consent to the use of sub-processors, the Processor must require that the sub-processor is subject to data processing obligations that are no less protective than those imposed on the Processor under the DPA. The Processor remains fully liable to the Controller for the acts and omissions of its sub-processors. In practice, cloud service providers often rely on a network of sub-processors (for example, infrastructure providers, analytics tools, and support platforms), and the DPA should include a mechanism for notifying the Controller of any changes to the sub-processor list.
The Privacy Act 2020 does not specify a universal retention period for personal information. Instead, the Act requires organisations to comply with IPP 9, which provides that an agency must not keep personal information for longer than is required for the purpose for which it may lawfully be used. This means that the appropriate retention period depends on the specific purpose of processing. For employment-related data, retention periods may be dictated by other legislation such as the Employment Relations Act 2000 and the Holidays Act 2003. For financial data, the Tax Administration Act 1994 requires certain records to be retained for seven years. The Data Processing Agreement should specify the Processor’s retention periods for each category of personal information, and should include a clear obligation to return or securely destroy personal information upon expiry or termination of the agreement.
This template is provided for informational purposes only and does not constitute legal advice. Laws vary by jurisdiction and change over time. Consult a qualified attorney for advice specific to your situation.Full disclaimer
Found an error? Let us knowRelated Documents
You may also find these documents useful:
Non-Disclosure Agreement (NDA) (New Zealand)
Protect your confidential business information under New Zealand law with a legally sound Non-Disclosure Agreement (NDA). Whether you are sharing trade secrets with a prospective partner, disclosing proprietary technology to a developer, or presenting financial projections to a potential investor, a properly drafted NZ NDA keeps your sensitive information under strict legal protection. Our template complies with the Contract and Commercial Law Act 2017 (CCLA) and includes provisions addressing the Privacy Act 2020 and the Information Privacy Principles (IPPs). Choose between a unilateral or mutual NDA, with optional non-solicitation and liquidated damages clauses.
Privacy Policy (New Zealand)
Create a compliant New Zealand Privacy Policy for your business or website. Our template is drafted in accordance with the Privacy Act 2020 (NZ) and covers all 13 Information Privacy Principles (IPPs), including IPP 1 (purpose of collection), IPP 3 (collection from subject), IPP 5 (storage security), IPP 6 (access), IPP 7 (correction), IPP 10 (limits on use), IPP 11 (limits on disclosure), and IPP 12 (unique identifiers and overseas disclosure). Includes mandatory privacy breach notification under sections 113-119 of the Privacy Act 2020, Privacy Commissioner complaint process, direct marketing obligations under the Unsolicited Electronic Messages Act 2007, and overseas data transfer provisions.
Data Protection Policy (New Zealand)
Create a comprehensive New Zealand Data Protection Policy compliant with the Privacy Act 2020, including mandatory privacy breach notification requirements under sections 113–116. Designates a Privacy Officer as required by section 211, covers all 13 Information Privacy Principles (IPPs), overseas disclosure under IPP 12, individual rights of access and correction, health information under the Health Information Privacy Code 2020, data retention under the Tax Administration Act 1994, and security safeguards under IPP 5. Suitable for New Zealand companies, non-profit organisations, and public sector agencies.
App Development Agreement (New Zealand)
Commission software development with confidence using a New Zealand App Development Agreement compliant with the Contract and Commercial Law Act 2017 (CCLA) and the Copyright Act 1994. This template clearly defines the project scope, milestones, payment schedule (including GST at 15%), intellectual property ownership, confidentiality obligations under the Privacy Act 2020, and a defect liability warranty period. Suitable for web, iOS, Android, and enterprise applications developed by NZ-based independent contractors or development studios.
Service Agreement (New Zealand)
Create a comprehensive New Zealand Service Agreement compliant with the Contract and Commercial Law Act 2017 (CCLA), Consumer Guarantees Act 1993 (CGA), and the Fair Trading Act 1986 (FTA). Covers scope of services, GST-inclusive or exclusive fees at 15%, payment terms, CGA consumer guarantees, intellectual property ownership under the Copyright Act 1994, confidentiality, Privacy Act 2020 obligations, limitation of liability, and termination rights. Suitable for consultants, freelancers, agencies, and businesses providing services across New Zealand.