Asia-Pacific · 2 laws · 10 requirements
New Zealand: the laws your website or app must follow
If your customers are in New Zealand, these are the privacy, consumer, security, accessibility and AI laws SafeLaunch checks your site against, with what each one requires and where in the law it says so.
How a SafeLaunch audit checks each one
- CheckedChecked automatically on every scan
- AI reviewLooked for by the AI analysis, reported only with evidence
- Your answersDecided from your answers to the audit questions
- PreparedPrepared for you in the report's compliance pack
- You confirmA scan can't see this; you need to confirm it
NZ Privacy Act 2020
In force since 1 December 2020; IPP 3A (telling people about information collected from others) since 1 May 2026.
Who it covers: Agencies in New Zealand, and overseas agencies carrying on business in New Zealand (s. 4).
What it requires of a website or app (8)
- A privacy notice at collection: who you are and how to reach you, purposes, who receives it, people's rightsCheckedPrivacy Act 2020 IPP 3 and IPP 3A
- A lawful basis, often consent, for each use of personal dataAI reviewPrivacy Act 2020 IPP 1–4 (purpose and manner of collection)
- People can access, correct and delete their data, and know how to askCheckedPrivacy Act 2020 IPP 6–7
- Reasonable securityCheckedPrivacy Act 2020 IPP 5
- Transfers abroad only with the safeguards the law setsCheckedPrivacy Act 2020 IPP 12
- Breach notification: Privacy Commissioner and affected people as soon as practicable if serious harmPreparedPrivacy Act 2020 s. 114–115
- A parent's consent for children's data (if if children use the product)Your answersPrivacy Act 2020 IPP 4 (fair collection, with particular care for children)
- Appoint a privacy officerPreparedPrivacy Act 2020 s. 201
NZ Unsolicited Electronic Messages Act 2007
In force; enforced by the Department of Internal Affairs.
Who it covers: Anyone sending commercial emails, texts or calls to people in the country.
What it requires of a website or app (2)
- Consent before commercial emails and texts (express, or inferred from a business relationship) (if if you send marketing emails or texts)Your answerss. 9
- Accurate sender information and a working unsubscribe in every message, honoured within 5 working days (if if you send marketing emails or texts)Your answerss. 10–11
Sources:New Zealand Legislation: Unsolicited Electronic Messages Act 2007
Licensed professionals in New Zealand
These regulators' advertising and conduct rules apply on top of the laws above, only to sites of that profession.
Check your site against New Zealand's rules
A free scan checks your website or app against these rules in about a minute and shows what applies, with evidence from your pages. The full report gives the exact fix for each finding.
Check my site freeOne free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked, plus the Monday briefing on new laws and deadlines. No spam, unsubscribe in one click.
By signing up you agree to get these weekly emails. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
A plain-language summary of what each law requires of a website or app, from the SafeLaunch rulebook, with the provision and official sources. It is not legal advice and not every duty in each law is listed.