Generally, an agency should not disclose personal information to another entity unless the disclosure of the information is one of the purposes in connection with which the information was obtained or is directly related to the purposes in connection with which the information was obtained. Care must be taken that all safety and security precautions are met to ensure the safeguarding of that personal information to make certain that it is not misused or disclosed to any other party.

Transfer of personal information to another agency to hold as the transferring agency's agent (e.g. for safe custody or processing) is not considered a disclosure of the information for the purposes of the Act.

Agencies must not disclose personal information to a foreign person or entity unless the agency reasonably believes:

• the relevant individual authorises the disclosure after being informed by the agency that the foreign person or entity may not be required to protect the information in a way that provides comparable safeguards to those in the Act;
• the foreign person or entity is carrying on business in New Zealand and the agency reasonably believes that, in relation to the information being disclosed, the foreign person or entity is subject to the Act;
• the foreign person or entity is subject to privacy laws that provide comparable safeguards to those in the Act;
• the foreign person or entity is a participant in a prescribed binding scheme;
• the foreign person or entity is subject to privacy laws of a prescribed country; or
• the foreign person or entity is required to protect the information in a way that provides comparable safeguards to those in the Act (e.g. pursuant to contractual clauses). New Zealand's Privacy Commissioner has released model contractual clauses that can be used to satisfy these exceptions, but it is not mandatory to use these exact provisions.

Additionally, the Privacy Commissioner is given the power to prohibit a transfer of personal information from New Zealand to another state, territory, province or other part of a country (State) by issuing a transfer prohibition notice (Notice) if it is satisfied that information has been received in New Zealand from one State and will be transferred by an agency to a third State which does not provide comparable safeguards to the Act and the transfer would be likely to lead to a contravention of the basic principles of national application set out in Part Two of the Organisation for Economic Co–operation and Development (OECD) Guidelines.

In considering whether to issue a Notice, the Privacy Commissioner must have regard to whether the proposed transfer of personal information affects, or would be likely to affect any individual, the desirability of facilitating the free flow of information between New Zealand and other States, and any existing or developing international guidelines relevant to trans–border data flows.

On December 19, 2012 the European Commission issued a decision formally declaring that New Zealand law provides a standard of data protection that is adequate for the purposes of EU law. This decision means that personal data can flow from the 27 EU member states to New Zealand for processing without any further safeguards being necessary.

Following the decision in the Schrems and Schrems II cases, there have been calls to review New Zealand's adequacy status, primarily due to New Zealand's membership with the Five Eyes network. In January 2024, the European Commission reviewed New Zealand's adequacy status. The review confirmed that New Zealand's adequacy status remains due to New Zealand's strengthened privacy legislation and clarification of certain privacy rules since the adoption of the initial adequacy decision, aligning it further with the EU framework.