Data Processing Agreement in New Zealand: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) in New Zealand governs how one party handles personal information on behalf of another. If you have used a European template, note the difference in language. New Zealand does not use the controller and processor labels. Under the Privacy Act 2020, the party that decides what happens to the information is an agency, and a supplier that holds personal information only to provide a service holds it as an agent. Information held by an agent is treated as held by the principal agency, so the principal stays responsible for it. That makes the DPA the document that sets out what the service provider may and may not do with the information. This guide explains the New Zealand framework, lists the clauses a DPA should contain, and gives a skeleton you can adapt. It is general information, not legal advice. Confirm the current position with a qualified New Zealand lawyer before you sign. ## The law that governs data handling in New Zealand - Privacy Act 2020. This is the main statute. It sets 13 information privacy principles (IPPs) covering collection, use, storage, access, correction, and disclosure of personal information.

• Agent rule. Where a service provider holds personal information solely to perform a task for a principal, the information is treated as held by the principal, so the principal must ensure the provider handles it within the principles.
• IPP 12, disclosure outside New Zealand. If personal information is sent to a provider overseas, the disclosing agency must take steps to ensure the information is protected by comparable safeguards, for example through contract terms, unless an exception applies.
• Notifiable privacy breaches. The Act requires an agency to notify the Privacy Commissioner and affected individuals if a privacy breach has caused, or is likely to cause, serious harm.
• Office of the Privacy Commissioner. The Commissioner issues guidance and codes of practice and can investigate complaints. ## Key clauses in a New Zealand DPA ### 1. Roles and subject matter Identify the principal agency and the service provider, confirm the provider acts as an agent, and describe the processing: nature, purpose, duration, categories of information, and individuals. ### 2. Scope and instructions Require the provider to handle personal information only on the principal's documented instructions and only for the agreed purposes. ### 3. Security safeguards Set reasonable security safeguards against loss, misuse, and unauthorised access, in line with IPP 5. Specify encryption, access control, and staff confidentiality. ### 4. Sub-processing Require prior approval for sub-providers and flow-down of equivalent obligations. ### 5. Privacy breach notification Require the provider to notify the principal without delay so the principal can assess serious harm and meet its notification duties to the Privacy Commissioner and affected individuals. ### 6. Disclosure outside New Zealand Address IPP 12. If information will be stored or accessed overseas, record the safeguards that make the destination comparable, or the exception relied on. ### 7. Access and correction Require the provider to help the principal respond to individuals exercising their access and correction rights under IPP 6 and IPP 7. ### 8. Return or deletion On termination, require the provider to return or securely delete personal information and certify deletion. ### 9. Audit and assurance Give the principal a right to verify compliance through information requests or audits. ### 10. Liability and term Allocate responsibility for breaches and align the DPA term with the main services contract. ## A simple clause skeleton 1. Parties and definitions

2. Roles and status as agent
3. Description of processing
4. Scope and instructions
5. Security safeguards
6. Sub-processing
7. Privacy breach notification
8. Disclosure outside New Zealand (IPP 12)
9. Assistance with access and correction
10. Return or deletion
11. Audit and assurance
12. Liability, term and termination ## One workspace to draft, review and track the agreement A DPA is only useful if it stays current. Sub-provider lists change, storage locations move, and breach notification windows are short, so the live version and its key dates need to be easy to find. Spread across email and folders, the current DPA and its obligations are easy to lose. Adira is an AI legal operating system that keeps drafting, review, clause-level editing, version history, and key-date tracking in one workspace, so the current DPA, its obligations, and its dates all live in one place. Indian data and corporate law is deepest today, and wider non-India jurisdiction depth, including New Zealand, is on the roadmap, so treat this page as general guidance and verify New Zealand specifics locally. You can see the product at Adira. ## Frequently asked questions