Subject to specific exceptions, agencies may collect, store and process personal information in accordance with the 13 IPPs summarised below.

IPP 1 – Purpose of collection of personal information

An agency must not collect personal information other than for a lawful purpose connected to the agency's functions, and only if the collection of the information is necessary for that purpose.

IPP 2 – Source of personal information

An agency must collect information directly from the relevant individual, unless one of the specified exceptions applies, which include if collection from the individual is not practical in the circumstances, if collection from a third party would not prejudice the interests of the individual, or if the information is publicly available.

IPP 3 – Collection of personal information from subject

Before collecting personal information, an agency has to make the relevant individual aware of certain things, such as the fact that information is being collected, the purposes for which it will be used, and the right to access and request correction of personal information. This is typically done by way of a privacy policy. There are several exceptions where the person collecting information would not need to comply with IPP 3, including where compliance is not reasonably practicable in the circumstances.

IPP 4 – Manner of collection of personal information

Agencies cannot collect personal information by unlawful or unfair means, or in a manner that intrudes to an unreasonable extent upon the personal affairs of the individual concerned. Particular care must be taken when collecting personal information from children or young persons.

IPP 5 – Storage and security of personal information

Agencies must ensure personal information is protected by reasonable security safeguards against loss and unauthorised access, use, modification or disclosure or other misuse. If it is necessary to give personal information to another person (e.g. a service provider), an agency must do everything reasonably within its power to prevent unauthorised use or disclosure of that information.

IPP 6 – Access to personal information

Where an agency holds personal information about an individual, subject to certain exceptions, if requested by the individual, the agency must confirm whether it holds the information and grant the individual access to it. The exceptions include where the information is not readily retrievable or:

• the refusal is for the protection of the health, safety or similar of an individual;
• in an employment context, the information is evaluative (e.g. compiled for the purpose of determining the suitability of an individual for employment) and disclosure would breach an implied promise that was made to the person who supplied the information;
• the information needs protecting because it would involve disclosure of a trade secret or be likely to unreasonably prejudice the commercial position of the person who supplied the information, unless the public interest in disclosure outweighs the withholding of the information;
• the information does not exist or cannot be found;
• the disclosure would involve the unwarranted disclosure of the affairs of another individual;
• the disclosure would breach legal professional privilege; or
• the request is frivolous or vexatious, or the information requested is trivial.

IPP 7 – Correction of personal information

An individual can request an agency to correct information the agency holds about the individual, or attach a statement of a correction sought but not made. If an agency has corrected personal information or attached a statement of a correction sought but not made, if reasonably practicable, it will inform each person or entity to whom it has disclosed that information of that correction or statement. The agency must inform the individual of any action taken as a result of the individuals request.

IPP 8 – Accuracy of personal information to be checked before use or disclosure

Agencies must take reasonable steps to ensure personal information they hold is accurate, up to date, complete, relevant, and not misleading.

IPP 9 – Agency not to keep personal information for longer than necessary

Agencies must not keep personal information for longer than is required for the purposes for which the information may lawfully be used.

IPP 10 – Limits on use of personal information

Agencies must not use personal information obtained in connection with one purpose for any other purpose unless the agency reasonably believes:

• the source of the information is publicly available and it would not be unfair or unreasonable to use that information;
• the use of the information for the other purpose is authorised by the relevant individual;
• non–compliance is necessary to avoid prejudice to the maintenance of the law by any public sector agency:
  • for the enforcement of a law imposing a pecuniary penalty;
  • for the protection of public revenue; or
  • for the conduct of proceedings before a court or tribunal;
• the use of the information for the other purpose is necessary to prevent or lessen a serious threat to public health or safety, or the life or health of an individual;
• the other purpose is directly related to the purpose for which the information was obtained, or the information is used in a form where the individual is not identified, or is used for statistical or research purposes and will not be published in a form where the individual could reasonably be expected to be identified.

IPP 11 – Limits on disclosure of personal information

Agencies must not disclose personal information for any purpose other than the purpose for which it was collected or a purpose directly related to the purpose for which it was collected unless the agency reasonably believes:

• the source of the information is publicly available and it would not be unfair or unreasonable to disclose that information;
• the disclosure is to the relevant individual;
• the disclosure is authorised by the relevant individual;
• non-compliance is necessary:
  • to avoid prejudice to the maintenance of the law by any public sector agency;
  • for the enforcement of a law imposing a pecuniary penalty;
  • for the protection of public revenue; or
  • for the conduct of proceedings before a court or tribunal;
• the disclosure of the information is necessary to prevent or lessen a serious threat to public health or safety, or the life or health of an individual;
• the disclosure is necessary to enable an intelligence and security agency to perform any of its functions;
• the disclosure is necessary to facilitate the sale or other disposition of a business as a going concern; or
• the information is to be used in a form where the individual is not identified, or is used for statistical or research purposes and will not be published in a form where the individual could reasonably be expected to be identified.

IPP 12 – Disclosure to an overseas person

Agencies must not disclose personal information to a foreign person or entity unless the agency reasonably believes:

• the relevant individual authorises the disclosure after being informed by the agency that the foreign person or entity may not be required to protect the information in a way that provides comparable safeguards to those in the Act;
• the foreign person or entity is carrying on business in New Zealand and the agency reasonably believes that, in relation to the information being disclosed, the foreign person or entity is subject to the Act;
• the foreign person or entity is subject to privacy laws that provide comparable safeguards to those in the Act;
• the foreign person or entity is a participant in a prescribed binding scheme;
• the foreign person or entity is subject to privacy laws of a prescribed country; or
• the foreign person or entity is required to protect the information in a way that provides comparable safeguards to those in the Act (for example, pursuant to contractual clauses). New Zealand's Privacy Commissioner has released model contractual clauses that can be used to satisfy these exceptions, but it is not mandatory to use these exact provisions.

IPP 13 – Unique identifiers

Agencies can only assign 'unique identifiers' to an individual if it is necessary to enable the agency to carry out one or more of its functions efficiently. The agency must not assign an individual a unique identifier that it knows has been assigned to that individual by another agency unless the unique identifier is being used for statistical or research purposes only. Additionally, the agency must take reasonable steps to ensure that unique identifiers are only assigned to individuals whose identities are clearly established and that the risk of the unique identifiers being misused is minimised. An agency must not require an individual to disclose any unique identifier assigned to them unless the disclosure is one of the purposes, or directly related to one of the purposes, for which that unique identifier was assigned.