Can You Use Existing Customer Data To Test A New Product?

When you're running a business, collecting customer information is often just part of the process. Whether it's contact details, purchase histories or account information, over time, your business can build up quite a collection of data.

Of course, there are privacy obligations to consider when collecting and handling this information. But once you've got it, you might start thinking about what else it could be useful for.

Perhaps you're developing a new product or service, and the customer data you've collected over the years could help you test your ideas, improve certain features or understand what your customers actually need.

After all, you've already collected the information, so why not put it to good use?

However, just because your business legally collected customer information doesn't necessarily mean you're free to use it for something entirely different.

Before using existing customer data for a new project, there are a few important privacy obligations worth understanding.

Can You Use Existing Customer Data For A Different Purpose?

Potentially, yes. However, it depends on why you originally collected the information and what you're planning to do with it now.

Under New Zealand's Privacy Act 2020, businesses generally need to follow the Information Privacy Principles (IPPs), which regulate how personal information is collected, used, stored and disclosed.

One of the most relevant rules is Information Privacy Principle 10 (IPP 10), which generally restricts businesses from using personal information for purposes other than those for which it was originally collected.

Say your business collects customer details to process online orders and arrange deliveries. A few years later, you decide to use those records to test a new product recommendation system.

Although you already hold the information, testing that system may involve using it for a different purpose.

Under IPP 10, certain additional uses are permitted where a business has reasonable grounds to believe a relevant exception applies. These include situations where:

• The new use is directly related to the original purpose.
• The individual has authorised the new use.
• The information is used in a form where the individual isn't identified.
• The information is used for statistical or research purposes and won't be published in a form that could reasonably identify the individual.

Other statutory exceptions may also apply.

Importantly, the research exception is separate from the exception for using information without identifying individuals. Qualifying research may involve identifiable information during the process, provided the relevant legal requirements are met.

However, ordinary commercial product testing doesn't automatically qualify as research simply because you're analysing customer information.

The key question is whether your proposed testing falls within the original collection purpose or an applicable legal exception.

Is Improving An Existing Product Different From Testing A New One?

There's a practical difference between improving a service customers already use and developing something entirely separate.

Imagine you operate an online booking platform.

You analyse customer activity to identify booking errors, improve existing features and understand where customers experience difficulties.

Depending on why the information was originally collected, these activities might fall within the original purpose or be directly related to it.

Now imagine you're developing an unrelated financial services product and want to use those same customer records to test how it works.

The connection to your original booking service is much less obvious.

Under IPP 10, the directly related purpose exception requires more than a loose connection between the original service and the new project. You need reasonable grounds to believe the proposed use is directly related to why the information was originally collected.

This doesn't mean developing a new product always requires customer authorisation. Another exception may apply.

Similarly, describing something as an improvement to an existing service doesn't automatically make every use lawful.

What matters is what you're actually doing with the information and whether you have a valid legal basis for using it that way.

When Do You Need Customer Authorisation?

If your proposed testing involves using identifiable customer information for a different purpose, and no other IPP 10 exception applies, you may need authorisation from the individuals concerned.

This is particularly relevant when you're developing a product or service that customers wouldn't ordinarily associate with your existing business.

For instance, a customer who provides their email address to receive order confirmations hasn't necessarily authorised you to analyse their purchase history to develop an unrelated product.

If you're seeking authorisation, it's important to clearly explain what information you intend to use, why you need it and what the proposed testing involves.

A broad statement about improving your services may not adequately cover an entirely different use of customer information.

You also shouldn't assume customers have agreed simply because they accepted your original terms and conditions or haven't objected to a change.

New Zealand's Privacy Act doesn't require authorisation for every additional use. However, you should establish which IPP 10 exception you're relying on before proceeding.

There can also be consequences for getting this wrong.

Using customer information in breach of the Privacy Act may lead to complaints to the Office of the Privacy Commissioner, investigations and, in appropriate circumstances, proceedings before the Human Rights Review Tribunal.

Taking the time to establish whether your proposed use is permitted can help avoid legal complications later.

Does Your Existing Privacy Policy Cover Product Testing?

Your business might already have a privacy policy explaining how customer information is collected, stored and used.

But does it accurately reflect what you're planning to do with that information now?

Under IPP 3, businesses collecting personal information directly from individuals generally need to take reasonable steps to make them aware of certain matters, including the purpose of collection and intended recipients, subject to applicable exceptions.

What customers were originally told can therefore be relevant when determining whether your proposed testing is directly related to the original collection purpose.

If your business collected information to provide one service but now wants to use it for something substantially different, your existing privacy documentation may not adequately explain that activity.

However, updating your privacy policy doesn't automatically authorise a new use of customer information.

You still need to determine whether the proposed testing is permitted under IPP 10.

There's also a newer privacy obligation worth keeping in mind.

Since 1 May 2026, IPP 3A has introduced notification requirements for certain situations where businesses collect personal information indirectly, such as obtaining information from another organisation.

If your new product involves gathering additional customer information from third parties, you may need to consider these requirements alongside the existing collection and use rules.

Having a tailored Privacy Policy can help your business communicate its information-handling practices clearly.

Can You Use Anonymous Or De-Identified Customer Data Instead?

What if your new product doesn't actually need to know who your customers are?

In some situations, using information without identifying individuals may be a more appropriate option.

Under IPP 10, one exception permits information to be used for a different purpose where it is used in a form in which the individual concerned isn't identified.

However, simply removing customer names or email addresses isn't necessarily enough.

Purchase histories, location information and combinations of other details may still allow individuals to be identified, particularly when datasets are linked together.

It's important to distinguish information that has been properly de-identified from information that merely has obvious identifiers removed.

Businesses should also consider whether the original preparation and de-identification of the information complies with their privacy obligations.

Where individuals remain identifiable, the information continues to be personal information and relevant privacy rules still apply.

Before using existing customer records for testing, consider whether anonymous, aggregated or synthetic information could achieve the same result.

This can help reduce unnecessary privacy risks while allowing your business to explore new ideas.

What If You're Using A Third-Party Testing Platform Or AI Tool?

Developing a new product often involves external software providers.

You might use an analytics platform to understand customer behaviour, a testing environment to experiment with new features or an AI tool to evaluate how a product performs.

But what happens to your customer information once another provider becomes involved?

Under IPP 5, businesses must protect personal information with reasonable security safeguards against loss, unauthorised access, use, modification, disclosure and other misuse.

Sharing customer information with an external provider can also raise questions under IPP 11, which governs the disclosure of personal information.

However, not every arrangement with a third-party provider is treated the same way.

For instance, a cloud service might store or process information solely on your behalf. Under section 11 of the Privacy Act, information held by a provider acting as your agent for storage or processing can generally be treated as information held by your business.

The situation can be different if the provider uses or discloses that information for its own purposes.

This is particularly relevant when using AI tools, as some providers may retain uploaded information to develop or train their own systems.

Where customer information is disclosed to another organisation for its independent use, you'll need to consider whether that disclosure is permitted under IPP 11.

What If The Testing Platform Is Based Overseas?

Using an overseas provider can introduce additional considerations.

Under IPP 12, certain disclosures of personal information to overseas recipients require appropriate privacy protections, subject to applicable exceptions.

However, using an overseas cloud service solely to store or process information on your behalf doesn't necessarily amount to an overseas disclosure under IPP 12.

The provider's role, the contractual arrangements and how the information will actually be used are important.

Before sharing customer information with a testing provider, review whether your agreement addresses confidentiality, security, permitted uses, subcontractors and what happens when the arrangement ends.

An appropriate Data Processing Agreement can help establish these responsibilities, although having an agreement doesn't automatically make an otherwise unlawful use or disclosure permissible.

It's also important to consider what happens to customer information once testing is complete.

Under IPP 9, businesses must not keep personal information for longer than required for the purposes for which it may lawfully be used.

You should therefore consider when testing information needs to be deleted or de-identified.

Businesses must also continue to meet relevant customer access and correction obligations under IPPs 6 and 7, including where personal information is held in external testing environments.

What Should You Check Before Using Customer Data For Product Testing?

Before putting existing customer information to work on a new project, it's worth making sure the proposed testing complies with your privacy obligations.

A few useful questions include:

• Why was the information originally collected? Review the original purpose and what customers were told.
• Is the new use permitted? Consider whether it falls within the original purpose or an IPP 10 exception.
• Do you need customer authorisation? Determine whether the proposed testing requires permission.
• Can you minimise the information used? Consider whether anonymous or synthetic data would be suitable.
• Who else will have access? Review third-party arrangements, security requirements and any overseas disclosures.

For projects involving particularly sensitive information, extensive profiling or emerging technologies, a privacy impact assessment may also be appropriate.

It's also worth distinguishing product testing from marketing.

If you're planning to contact existing customers to promote your new product, additional requirements may apply under the Unsolicited Electronic Messages Act 2007 and relevant privacy principles.

Addressing these issues before testing begins can help avoid privacy problems becoming a much bigger concern when your new product is ready to launch.

Need Help With Your Business's Privacy Obligations?

Existing customer information can be valuable when developing new products, but it's important to understand what your business can legally do with it.

Whether you're reviewing how customer information is used, updating your privacy documentation or working with external testing providers, understanding your obligations early can help avoid complications later.

Sprintlaw can assist with Privacy Policies, Data Processing Agreements and Privacy Advice for businesses managing customer information.

Get in touch with our team on 0800 002 184 or email team@sprintlaw.co.nz to find out how we can help.