Privacy Act 2020 Checklist For Ecommerce Stores

Yes - if you run an online store in New Zealand, your privacy policy needs to match what you actually collect, use, store and share under the Privacy Act 2020.

The slightly trickier part is that ecommerce privacy is rarely just one form on one website. You might collect checkout details, send email marketing, use analytics pixels, pass addresses to couriers, take payments through a third party and store data in cloud tools overseas.

That doesn't have to be overwhelming. A good privacy check is really about mapping what happens to customer information in your store, then making sure your notices, consents, contracts and internal processes line up with that reality.

Does The Privacy Act 2020 Apply To My Online Store?

Yes, in most cases the Privacy Act 2020 applies to your online store if you collect personal information from customers in New Zealand.

Personal information means information about an identifiable person. For an ecommerce store, that usually includes:

• Names, delivery addresses and billing addresses
• Email addresses and phone numbers
• Order history and product preferences
• Customer account logins and loyalty programme details
• IP addresses, device IDs and cookie or analytics data, where it can identify or be linked to a person
• Customer service messages, returns information and complaints

The Privacy Act is built around 13 Information Privacy Principles, often called IPPs. They cover when and how you collect information, what you tell customers, how you store information, when you can use or disclose it, how customers can access and correct it, and what happens if you send it overseas.

There isn't a minimum size threshold for ordinary businesses. You don't get an exemption just because you're a small store, a side hustle or a startup using Shopify, WooCommerce, Squarespace or another platform.

The good news is that your obligations should scale with what you're doing. A simple store selling candles and using one email platform will usually need a simpler setup than a marketplace processing vendor payouts, customer profiles and automated product recommendations.

What Customer Data Does An Ecommerce Store Usually Collect?

You should identify every type of customer data you collect before you update your privacy policy, because your policy should describe your real data practices, not an ideal version of them.

A practical way to do this is to follow a customer journey from browsing to delivery and after-sales support.

Checkout And Account Data

At checkout, you may collect names, contact details, delivery instructions, billing details, discount codes, account passwords and order notes. If you let customers create accounts, you may also store purchase history, wish lists and saved addresses.

Payments And Fraud Checks

Many stores use payment providers rather than handling full card details themselves. Even then, you may receive transaction IDs, partial card details, fraud risk scores, billing addresses and chargeback information, so your payments privacy practices should be clear. Your privacy policy should explain that a payment provider is involved and why that information is used.

Marketing, Analytics And Personalisation

Your website might also collect browsing data through cookies, pixels and analytics tools. That can include pages viewed, products added to cart, location estimates, device information and whether a customer came from an ad campaign.

Say Kiri runs an online skincare store in Wellington. Her checkout collects names, addresses and phone numbers. Her email platform has 8,000 subscribers. Her analytics tool tracks product page views, and her abandoned cart app sends a reminder 4 hours after checkout is left unfinished. Kiri's privacy policy needs to cover each of those workflows, not just the checkout form.

What Should My Ecommerce Privacy Policy Say?

Your privacy policy should clearly tell customers what information you collect, why you collect it, who you share it with, where it may be stored and how customers can contact you about privacy.

A plain-English privacy policy is often more useful than a long document full of generic wording. Customers should be able to understand what happens to their information without needing legal training.

Here is a fill-in outline you can use as a starting point. Treat this as a drafting guide, not a finished legal document. A privacy lawyer or experienced legal adviser should tailor it before you publish it.

1. Who You Are: Write your legal business name, trading name, NZBN if you have one, and contact details for privacy questions.
2. What You Collect: List the types of personal information you collect through your website, checkout, accounts, marketing and customer support.
3. How You Collect It: Explain whether information comes directly from customers, website tools, payment providers, couriers, social media platforms or other sources.
4. Why You Use It: Describe the purposes, such as processing orders, delivery, customer support, fraud prevention, email marketing, analytics and improving your store.
5. Who You Share It With: Name the categories of third parties, such as payment providers, courier companies, website hosts, email platforms, analytics providers and professional advisers.
6. Overseas Disclosure And Storage: Say if customer information may be stored or processed outside New Zealand, and describe the safeguards you rely on.
7. Cookies And Tracking: Explain the types of cookies or tracking tools you use, whether you have a cookie policy, and how customers can manage them.
8. Access And Correction: Tell customers how they can ask for access to or correction of their personal information.
9. Security And Retention: Describe how you protect information and how long you keep it, including any data retention policy, in practical terms.
10. Complaints And Contact: Give a privacy contact and explain how privacy concerns can be raised with your business.

Your policy should also line up with the Fair Trading Act 1986. If you say you never share data with third parties but your email platform, courier and analytics tools all receive customer data, that statement may be misleading.

Do I Need Consent For Email Marketing, Cookies And Analytics?

It depends on the activity, but you should be clear and honest about marketing, cookies and tracking tools before you use customer data for those purposes.

For email and text marketing, the Unsolicited Electronic Messages Act 2007 is the key law to keep in mind. In broad terms, your commercial messages should have:

• Consent: This may be express consent, such as ticking a marketing box, or inferred consent in limited cases where the relationship and message make that reasonable.
• Sender Identification: Customers should be able to tell who sent the message.
• An Unsubscribe Option: You need a clear way for people to opt out, and it needs to work.

For ecommerce stores, the safest approach is usually to keep marketing consent separate from accepting your website terms or completing a purchase. Pre-ticked boxes can create confusion and may not reflect genuine consent.

For analytics and advertising pixels, the Privacy Act still matters even though New Zealand doesn't have the same cookie consent rules as some overseas countries. You should explain what tracking tools do, why you use them and when data is shared with platforms such as analytics providers, ad networks or social media tools.

Think about your abandoned cart emails too. If someone enters an email address but doesn't finish buying, ask yourself whether you've clearly told them you may use that email to follow up. Your checkout wording, privacy policy and email settings should all match.

Can I Share Customer Data With Couriers, Payment Providers And Offshore Platforms?

Yes, you can usually share customer data with service providers if it's necessary for your store to operate, but you need to be transparent and manage the privacy risk.

Most ecommerce stores rely on third parties. For example:

• Payment providers process payments and help prevent fraud
• Couriers receive names, addresses, phone numbers and delivery instructions
• Email platforms store subscriber lists and campaign activity
• Website hosts and cloud tools store order and account data
• Analytics and advertising platforms receive browsing or campaign data

Under the Privacy Act 2020, offshore disclosure needs extra care. If you disclose personal information to an overseas organisation, you generally need to make sure the information will be protected by comparable privacy safeguards, or you need to tell the customer and get authorisation for that disclosure.

Cloud storage can be tricky because your data may be hosted in Australia, the United States, Singapore or another country, even if your business is based in New Zealand. Check your platform's data processing terms, privacy settings and sub-processor information.

For key suppliers, your contracts should deal with privacy. Look for clauses that cover:

• What customer information the supplier can use and for what purpose
• Security standards, access controls and any information security policy requirements
• Whether data can be sent offshore or shared with sub-processors
• What happens if there's a data breach
• Data return or deletion when the relationship ends

Templates can miss these supplier-specific details, especially where your tech stack changes over time. It's worth reviewing your contracts when you add a new platform that handles customer information.

How Do I Run A Privacy Act 2020 Checklist For My Store?

You can run a useful privacy checklist by mapping your data flows first, then checking your customer notices, consents, suppliers and internal processes against that map.

Here is a practical checklist you can work through.

1. List Your Data Points: Write down every place you collect personal information, including newsletter forms, checkout, customer accounts, reviews, returns forms, live chat and support emails.
2. Map Where The Data Goes: Note which platforms receive each type of information, including your ecommerce platform, payment provider, email tool, courier system, analytics tools and accounting software.
3. Check Your Purpose: For each data point, ask why you need it. If you don't need a date of birth, phone number or delivery instruction field, consider removing it.
4. Match Your Privacy Policy: Update your policy so it accurately reflects your actual collection, use, disclosure, storage and offshore processing.
5. Review Marketing Consent: Check that subscribers have properly opted in, and that every marketing message identifies your business and has a working unsubscribe option.
6. Review Supplier Terms: Make sure key platforms and providers have privacy and security terms that suit your business.
7. Set Access And Correction Processes: Under the Privacy Act, you generally need to respond to access requests as soon as reasonably practicable and no later than 20 working days.
8. Plan For Privacy Breaches: If a breach is likely to cause serious harm, you need to notify the Office of the Privacy Commissioner and affected people as soon as practicable.
9. Train Your Team: Anyone handling orders, refunds, customer messages or marketing lists should know what they can and can't do with customer data.

Keep a simple record of this review. For example, Kiri records that her email platform stores subscriber data offshore, her courier receives delivery details only, and her team deletes old export spreadsheets every month under a simple data retention process. That record makes future reviews much easier.

Common Ecommerce Privacy Mistakes To Avoid

The most common privacy mistakes usually happen because your store grows faster than your documents and processes.

Watch out for these issues:

• Using A Generic Privacy Policy: A copied policy may leave out your actual tools, marketing workflows or offshore storage.
• Collecting More Than You Need: Extra data creates extra risk. If you don't use it, don't collect it.
• Forgetting About Apps And Plugins: Discount tools, review apps, live chat, loyalty programmes and retargeting pixels may all receive customer data.
• Blending Order Updates With Marketing: A receipt or shipping update is different from a promotional email. Treat marketing consent carefully.
• Ignoring Staff Access: Limit access to customer data to the people who need it for their role.
• No Breach Plan: If an account is compromised or a customer list is emailed to the wrong person, you need to know who will assess the risk and what records to keep.

If something goes wrong, act in order. Secure the system first, work out what information was affected, keep a record of what happened, assess whether serious harm is likely, then notify the Office of the Privacy Commissioner and affected people if required.

You don't need a perfect privacy system on day one. You do need a system that's accurate, maintained and appropriate for the way your store actually works.

Key Takeaways

• The Privacy Act 2020 usually applies to New Zealand ecommerce stores that collect customer personal information.
• Your privacy policy should match your real workflows, including checkout data, email marketing, analytics, payment providers, couriers and cloud storage.
• Marketing consent, unsubscribe options and sender details matter under the Unsolicited Electronic Messages Act 2007.
• Offshore platforms and third-party apps need extra care, especially where customer data is stored or processed outside New Zealand.
• You generally need to respond to customer access requests within 20 working days and notify serious privacy breaches as soon as practicable.
• A simple data map, updated privacy policy and supplier review can go a long way in protecting your store as it grows.

If you'd like help with your ecommerce privacy policy, data collection notices, marketing consent wording and supplier privacy clauses, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.