Privacy Act 2020 and the 2025 Amendment: What NZ Schools Need to Know

Written by Dr Craig Hansen, PhD — Summit Institute

Within the context of a New Zealand school — where the School Board acts as the statutory "agency" — the Privacy Act 2020 and the Privacy Amendment Act 2025 have changed how student, staff, and whānau data must be managed. These changes are not minor. They reshape the legal duties that every state and state-integrated school in Aotearoa New Zealand must meet when collecting, storing, using, and sharing personal information.

The latest version is the Privacy Act 2020, as amended by the Privacy Amendment Act 2025 which came into force on 1 May 2026. For schools, this means new obligations around indirect data collection, stronger breach notification requirements, and expanded enforcement powers held by the Privacy Commissioner.

Key Updates and Latest Changes

• Information Privacy Principle 3A (IPP 3A): Introduced by the 2025 amendment, agencies must now notify individuals when their personal information is collected indirectly from a third party (unless a specific exception applies). The Ministry of Justice announced this new principle as a significant shift in how indirect data collection is handled.
• Core Framework: The Act replaced the older Privacy Act 1993 and governs how public and private sector agencies collect, store, use, and share personal information. The Office of the Privacy Commissioner oversees compliance with the 13 Information Privacy Principles.
• Breach Notification: Mandatory reporting to the Office of the Privacy Commissioner and affected individuals if a privacy breach causes or is likely to cause serious harm.
• Commissioner Powers: The Privacy Commissioner can issue binding decisions on access requests and issue formal compliance notices — powers that did not exist under the previous Act. The Justice Sector regulatory framework confirms these enhanced enforcement capabilities.

Here is how those four pillars translate into key understandings and required actions for schools.

The four pillars of the Privacy Act 2020 for New Zealand schools. Click to view full size.

1. Information Privacy Principle 3A (IPP 3A) — Indirect Collection

Schools frequently collect personal data about a student or staff member from third parties — such as receiving records from a student’s previous school, health reports from a clinic, notes from a Ministry of Education specialist, or references for a new teacher hiring process. Previously, schools only had a strict duty to notify individuals when collecting data directly from them. Under IPP 3A, schools must now notify the individual when their data is collected indirectly, unless a specific legal exception applies.

How IPP 3A works in practice: indirect data collection triggers a notification obligation. Click to view full size.

Actions Schools Might Need to Take

• Map Data Inflows: Audit all methods by which the school receives student or staff data from outside sources (e.g., enrolment transfers, external counselling, AI learning software tracking).
• Update Enrolment and Privacy Policies: Revise the school’s Privacy Statement to explicitly state what information is collected from third parties, why it is collected, and who it is shared with.
• Issue Post-Collection Notifications: When receiving unsolicited or third-party reports regarding a student, take reasonable steps to inform the student (or their parents/caregivers, depending on the child’s age and maturity) that this information has been logged, as soon as practically possible. Legal firms Duncan Cotterill and Cooney Lees Morgan have published detailed guidance on these notification requirements.

2. Core Framework (Privacy Act 2020)

Key Actions

• Appoint and train a Privacy Officer — typically the Principal or a senior administrator — trained on all 13 Information Privacy Principles.
• Review digital platforms — vet cloud-based student management systems, e-learning apps, and digital portfolios for secure, compliant data storage. PwC New Zealand and Cygnus Law offer practical vendor due diligence guidance.

3. Mandatory Breach Notification

Schools handle highly sensitive data, including pastoral care notes, family court orders, psychological assessments, and financial details. If a data breach occurs — such as emailing a student report to the wrong parent or a ransomware attack on the school network — and it is likely to cause serious harm, it is legally notifiable.

Actions Schools Might Need to Take

• Establish a Breach Response Plan: Create a clear, step-by-step internal checklist for staff to follow the moment a data leak or cyber incident is suspected.
• Report Promptly: If a breach meets the serious harm threshold, the school must notify the affected individuals and the Office of the Privacy Commissioner immediately.

4. Commissioner Powers

Key Actions

• Refine your information access protocol — train admin staff to recognise and process IPP 6 access requests promptly and correctly.
• Maintain accurate records — regularly purge outdated data and keep files clear of subjective, unsubstantiated staff comments. The NZ Principal magazine offers a practical guide on managing information rights in schools.

Summary: School Compliance Checklist

For schools exploring how AI tools interact with these privacy obligations, Future Learning’s AI Readiness Review and the ComplyWith guide to IPP 3A offer practical starting points. The Office of the Privacy Commissioner’s children’s privacy guidance (PDF) also includes a full chapter on keeping learners and parents informed.

For further reading on AI governance for NZ school leaders and boards, see our complete guide to AI in New Zealand schools and our resources on AI in education at Summit Institute.