Home
5
Services
5
UK-New Zealand Data Transfer Support

UK-New Zealand Data Transfer Support

New Zealand holds UK adequacy, so you do not need an IDTA to send personal data there. That is genuinely good news, and it is also where most businesses stop thinking - which is the problem. Adequacy covers the transfer mechanism and nothing else. We confirm your transfers are properly covered, deal with the onward transfers adequacy does not reach, and build the fallback you will need if the position ever changes.



Speak to an expert
01234 923643

Data protection expertise trusted by hundreds of organisations.

Get a Fast UK-New Zealand Data Transfer Support Quote

Start with the good news: you almost certainly do not need an IDTA

New Zealand is one of the small number of jurisdictions the UK recognises as providing an adequate level of data protection. The original finding came from the European Commission in 2012, on the strength of New Zealand’s Privacy Act and its independent Privacy Commissioner, and it was carried into UK law when the transition period ended.

The practical effect is that a transfer of personal data from the UK to New Zealand is not a restricted transfer requiring an Article 46 safeguard. You do not need an International Data Transfer Agreement. You do not need the UK Addendum to the EU SCCs. You do not need to complete a Transfer Risk Assessment for the transfer itself.

We say this plainly because a number of compliance providers do not. If you have been sold an IDTA for a straightforward UK-to-New Zealand flow, you have paid for a document that was not required. This is also the clearest single difference between New Zealand and Australia, which has no UK adequacy decision and where an IDTA and a TRA are both genuinely needed.

Adequacy covers the transfer mechanism. It does not cover the processing.

Adequacy answers one question – may the data leave the UK – and no others. Everything else in UK GDPR still applies in full to a UK controller sending data to New Zealand.

You still need an identified Article 6 lawful basis for the processing. You still need an Article 28 processor contract with the mandatory terms, and ‘we rely on adequacy’ is not a substitute for one. You still need the transfer recorded in your record of processing activities, with the recipient, the purpose and the retention period. You still owe individuals transparency about where their data goes. You still need appropriate technical and organisational measures, and if the New Zealand processing is high-risk, you still need a DPIA.

In our experience this is where UK-New Zealand flows actually fail an audit. Not on Chapter V, which adequacy handles, but on the unremarkable Article 28 and Article 30 obligations that nobody thought to check because the transfer question had a comfortable answer.

Audit Your NZ Data Transfers

What UK-New Zealand Data Transfer Support covers

A straight answer on whether you need anything at all

We confirm whether your flow is covered by UK adequacy, in writing. Where no transfer mechanism is required, we tell you that and document why - rather than selling you an IDTA you do not need.

Onward transfer and sub-processor mapping

The real risk in a UK-NZ flow. We map where your New Zealand recipient sends data next - Australian regions, US infrastructure,

Article 28 contracts and RoPA entries

Adequacy does not replace a processor agreement or a record of processing. We check both, because this is where UK-New Zealand flows actually fail an audit.

A documented adequacy fallback

Contract drafting that lets you switch to an IDTA if the UK's adequacy position ever changes, so a policy decision in Whitehall does not become a renegotiation across your whole supplier base.

IPP 12 alignment for the New Zealand side

We check how your counterparty's obligations under Information Privacy Principle 12 of the Privacy Act 2020 interact with your UK obligations, so one set of documents governs the flow.

Incident response across both regimes

New Zealand has a mandatory notifiable privacy breach regime and the UK has a 72-hour ICO duty. We make sure your breach plan works when the incident sits in Auckland and the data subjects are in the UK.

Where adequacy runs out: onward transfers, contingency and scope creep

There are three situations where a UK-New Zealand flow needs real work.

The first is onward transfers. Adequacy covers the hop to New Zealand. It does not cover what your New Zealand recipient then does. A New Zealand SaaS provider running on Australian or United States infrastructure, using offshore support or an offshore backup region, is moving your data into jurisdictions that have no UK adequacy. As the UK controller, you remain accountable for that chain, so the sub-processor list is the document that matters – not the adequacy finding.

The second is contingency. Adequacy is a policy decision, subject to monitoring and review, and the Data (Use and Access) Act 2025 recast how the UK government assesses and maintains these findings. It is unlikely to be withdrawn for New Zealand, but it is not a permanent feature of the landscape. Well-drafted contracts include a fallback clause so that if the position changes you can switch to an IDTA without renegotiating from scratch.

The third is scope creep. Adequacy applies to New Zealand, and the Privacy Act 2020 does not extend to all of the Realm of New Zealand in the same way. If your flow touches Tokelau, or an entity operating outside the Act’s reach, the comfortable answer stops applying. This is rare, but it is worth ten minutes of checking rather than an assumption.

The New Zealand side: IPP 12 and a moving target

Your New Zealand counterparty has its own cross-border rule. Information Privacy Principle 12 of the Privacy Act 2020 restricts disclosure of personal information outside New Zealand unless the receiving agency is subject to comparable safeguards – the mirror image of the question you are asking about them.

New Zealand’s regime has moved recently, and both changes are now fully in force. The Privacy Amendment Act 2025 introduced a new information privacy principle, IPP 3A, which came into force on 1 May 2026 and requires an agency collecting personal information indirectly to take reasonable steps to make that individual aware of the collection. Separately, the Biometric Processing Privacy Code 2025 took effect on 3 November 2025 for biometric processing that began after that date, and on 3 August 2026 for processing already underway, so it now applies across the board. New Zealand has also operated a mandatory notifiable privacy breach regime since the 2020 Act came into force, which matters for any incident response plan spanning both countries.

What we will not do is tell you New Zealand’s regime is ‘basically GDPR’. It is not: there is no equivalent to the GDPR administrative fining regime, the rights set is narrower, and the compliance culture is different. Anyone briefing you otherwise has not read it.

UK-New Zealand data transfer questions, answered

Do we need an IDTA to send personal data to New Zealand?

In almost all cases, no. New Zealand is recognised by the UK as providing an adequate level of data protection, so a transfer of personal data from the UK to New Zealand is not a restricted transfer and does not require an Article 46 safeguard such as the IDTA or the UK Addendum. You also do not need a Transfer Risk Assessment for the transfer itself. If you have been advised to put an IDTA in place for a simple UK-to-New Zealand flow, ask why. The exceptions worth checking are onward transfers from New Zealand to non-adequate countries, and unusual cases where the recipient falls outside the reach of the Privacy Act 2020.

Then what do we actually have to do?

Everything else UK GDPR requires. Identify and record your lawful basis. Put an Article 28 processor agreement in place with the mandatory terms. Record the transfer in your record of processing activities, with recipient, purpose and retention. Tell individuals about it in your privacy notice. Apply appropriate security measures, and run a DPIA if the processing is high-risk. Adequacy answers the ‘may it leave the UK’ question and nothing more – and in our experience it is these routine obligations, not Chapter V, that fail an audit on New Zealand flows.

Why does Australia need an IDTA when New Zealand does not?

Because adequacy is a country-by-country political and legal assessment, not a regional one. New Zealand’s Privacy Act and independent Privacy Commissioner were assessed as providing essentially equivalent protection in 2012, and the UK carried that finding forward. Australia has never been the subject of an equivalent finding – partly because of features of the Privacy Act 1988 such as the historic small business exemption and the scope of its exemptions generally. So a Sydney office and an Auckland office are, for transfer purposes, in genuinely different positions. If your business sends data to both, you need an IDTA and a TRA for one and not the other.

Our New Zealand supplier hosts data in Australia. Does adequacy still help?

Only for the first hop. UK adequacy for New Zealand does not sanitise an onward transfer from New Zealand to a country without UK adequacy, and Australia has none. As the UK controller you remain accountable for the whole chain, so you need to know your supplier’s hosting regions, backup regions, sub-processor list and support locations. This is the single most common real problem on UK-New Zealand flows, and it is the reason the sub-processor annex matters more than the adequacy finding.

Could the UK withdraw adequacy for New Zealand?

It is possible in principle and unlikely in practice. Adequacy findings are subject to ongoing monitoring and periodic review, and the Data (Use and Access) Act 2025 restructured how the UK assesses and maintains them. New Zealand’s regime has been strengthening rather than weakening, so there is no current indication of risk. The sensible response is not to plan for withdrawal but to make it cheap to handle: include a transfer-mechanism fallback clause in your contracts so you can move to an IDTA without reopening commercial terms.

Is the New Zealand Privacy Act equivalent to UK GDPR?

No, and it is worth being precise about this. The Privacy Act 2020 works through 13 Information Privacy Principles, has a mandatory notifiable privacy breach regime, and an independent Privacy Commissioner with meaningful investigatory powers. What it does not have is an administrative fining regime comparable to UK GDPR, or the full UK rights set – there is no directly equivalent right to erasure or to data portability, and no general DPO or DPIA mandate. It was judged adequate in the sense of providing essentially equivalent protection for transferred data, which is a different test from being identical. This distinction became topical in the UK when New Zealand’s model was cited as a template for reforming UK GDPR.

We are a New Zealand company with UK customers. Does adequacy mean UK GDPR does not apply to us?

No – and this is the most expensive misunderstanding in this whole area. Adequacy is about whether a UK exporter may send data to New Zealand. It says nothing about whether UK GDPR applies to you directly. If you offer goods or services to individuals in the UK, or monitor their behaviour, UK GDPR applies to you under Article 3(2) and you will normally need a UK representative under Article 27. Our UK GDPR Support for New Zealand Companies page covers that in full.