ShareAndGoShareAndGo

Privacy

GDPR for New Zealand businesses: when it reaches you, and what adequacy means.

The European Union's General Data Protection Regulation, the GDPR, is often described as Europe's privacy law with a global reach. For a New Zealand business with no office in Europe, the obvious question is whether any of it applies. Sometimes it does, and the answer depends on what you do rather than where you are.

New Zealand also has an unusual advantage: the European Commission has decided that New Zealand provides an adequate level of protection for personal data. This article explains when the GDPR can reach a New Zealand business, what that adequacy decision means in practice, and how to approach the documents you share. It is a general explanation. Take advice on your own situation.

When the GDPR can apply to a business here

The GDPR applies to organisations established in the EU. Article 3 of the Regulation also extends it to organisations outside the EU in two situations: where they offer goods or services to people in the EU, or where they monitor the behaviour of people in the EU, for example through tracking on a website.

Offering goods or services means more than having a website that Europeans can visit. The Regulation's recitals point to signs that a business is targeting people in the EU, such as using a European language or mentioning customers there, and in practice shipping to EU countries or advertising aimed at EU audiences point the same way. A Wellington software company selling subscriptions to customers in Germany is in a very different position from an Auckland café whose website a tourist once read.

Other ways the GDPR shows up

Even where the GDPR does not apply to you directly, it can arrive through contracts. A European customer or partner that is subject to the GDPR may require you to sign data processing terms before it sends you personal information. If you provide services to such a business, those terms are often non-negotiable, and you will need to be able to show how you handle the information.

What New Zealand's adequacy decision means

On 19 December 2012 the European Commission decided that New Zealand ensures an adequate level of protection for personal data. That decision was made under the EU's earlier data protection directive and continues under the GDPR. In January 2024 the Commission published its first review of adequacy decisions under the GDPR and concluded that New Zealand continues to provide an adequate level of protection for personal data transferred from the EU, pointing among other things to the reforms in New Zealand's Privacy Act.

In practical terms, adequacy means personal data can flow from the EU to New Zealand without the extra transfer mechanisms, such as standard contractual clauses, that the GDPR requires for most other countries. That makes New Zealand an easier partner for European businesses.

What adequacy does not do

  • It does not exempt a New Zealand business from the GDPR where Article 3 applies to it directly.
  • It covers transfers into New Zealand. If you then send that information on to another country, the onward transfer needs its own thought.
  • It does not replace New Zealand's own privacy principles, which apply to you regardless.

Practical first steps

  1. Work out whether you offer goods or services to people in the EU, or monitor their behaviour online. If neither, the GDPR probably does not apply to you directly.
  2. List the European customers and partners who send you personal information, and the terms they have asked you to sign.
  3. Map where that information goes once it reaches you, including the cloud services you use and where they operate.
  4. Check you could answer a request from a person to see or correct their information, which both the GDPR and New Zealand's privacy principles provide for.
  5. Review how you share documents containing personal information with third parties.

Sharing documents that contain personal data

Deals, audits and reviews often involve documents full of personal data: employee files, customer lists, contracts signed by individuals. Whether those documents are governed by New Zealand's privacy principles, the GDPR or both, the questions are similar: who received them, what could they do with them, and when did access end.

A data room answers those questions better than email. In ShareAndGo, each person confirms their email address with a six-digit code, groups see only the folders you allow, view-only recipients never receive the original file, and pages can carry the viewer's name, email address and the date. Every view and download is recorded in a chained audit log you can export as a CSV.

Where a European partner asks where documents are held, give them the full answer, including the services that run in other countries, and let them assess it.

Questions people ask

Does the GDPR apply to every New Zealand business with a website?
No. Under Article 3 it reaches businesses outside the EU when they offer goods or services to people in the EU or monitor their behaviour there. A website Europeans can visit is not enough on its own.
What is New Zealand's EU adequacy status?
The European Commission decided in December 2012 that New Zealand ensures an adequate level of protection, and its January 2024 review concluded that it continues to do so. Personal data can therefore flow from the EU to New Zealand without extra transfer mechanisms.
Where does ShareAndGo keep documents?
Your documents are stored in Sydney, Australia.

Keep reading

Where your data lives, and why New Zealand businesses ask

How the Privacy Act treats overseas storage and cloud providers, and what you stay responsible for.

Writing a data sharing agreement that does its job

The clauses worth your attention when personal or commercial information is shared with another party.

Privacy policy

What we collect, why, where documents are kept, and the services that run overseas.