Do I Need A Privacy Impact Assessment For My App?

Maya is getting ready to launch a wellness app in Auckland. It tracks users' sleep, mood, workouts and location so it can suggest personalised routines. Her developer asks one simple question: "Have we done the privacy assessment yet?"

If you're building an app, that question can feel like one more thing between you and launch day. The good news is that a privacy impact assessment, often called a PIA, doesn't have to slow you down. Done well, it helps you spot privacy risks early, tighten your product decisions and avoid expensive rebuilds later.

For many apps, a PIA isn't just a paperwork exercise. If your app collects location, health, children's, financial or automated decision-making data, including sensitive information, it's usually a smart step before release.

Do I Need A Privacy Impact Assessment For My App?

It depends, but if your app collects sensitive, high-volume or unexpected personal information, you should strongly consider doing a privacy impact assessment before launch.

In New Zealand, the Privacy Act 2020 doesn't say that every app must complete a PIA. Instead, it sets rules for how your business collects, uses, stores, shares and deletes personal information. A PIA is the practical tool that helps you check whether your app design actually meets those rules.

A PIA is especially useful if your app is new, your data use is unusual, or your users wouldn't reasonably expect the information you're collecting. For example, a simple booking app that collects a name, email address and appointment time may only need a light privacy check. A fitness app that tracks GPS routes, heart rate, injuries and in-app messages needs a much deeper review.

You should also think about your commercial reality. App stores, investors, enterprise customers and health sector partners may ask what privacy checks you've done. If you can't show your thinking, privacy can become a product, funding or sales problem.

A good PIA helps you answer questions like:

• What personal information are we collecting, and why?
• Could we offer the feature with less data?
• Who can access the data inside the business?
• Are we using overseas service providers?
• What happens if the app is hacked, misconfigured or used in an unexpected way?

What App Data Triggers A Privacy Impact Assessment In New Zealand?

You should do a PIA when your app collects data that creates a higher privacy risk for users or your business.

Some apps only collect basic account details. Others collect information that can reveal where someone goes, how healthy they are, what they earn, who their children are, or how an algorithm ranks them. That second group needs careful attention.

Common PIA triggers for an app include:

• Location data: GPS tracking, background location, geofencing, movement history or delivery tracking.
• Health information: symptoms, medications, diagnoses, mental health notes, disability information, fitness metrics or clinical records.
• Children's information: accounts used by children, school apps, parenting apps, learning platforms or apps where children can upload photos or messages.
• Financial information: bank details, transaction data, credit checks, affordability assessments, payment behaviour or budgeting profiles.
• Automated decision-making: AI scoring, risk ratings, eligibility decisions, personalised pricing, content moderation or recommendation engines that affect users in a meaningful way.
• Biometric or identity data: face scans, voiceprints, identity verification documents or liveness checks.
• Large-scale analytics: tracking across devices, behavioural profiling, advertising IDs or third-party analytics that build detailed user profiles.
• Indirectly collected data: information collected from connected devices, social logins, partners, APIs, analytics tools or other third-party sources.

You don't need to panic if one of these applies. It just means you should pause and check the design before launch. Often, the best privacy fix is also a good product fix: collect less data, keep it for less time, give users clearer choices, or separate information so fewer people can access it.

If your app combines several triggers, such as health data plus AI recommendations plus overseas hosting, a PIA becomes much more important.

How Does The Privacy Act 2020 Apply To Apps?

The Privacy Act 2020 applies to your app if your business collects personal information and is covered as an "agency" under the Act.

For most startups and SMEs, that will be the case. The Act can also apply to overseas businesses that are carrying on business in New Zealand, even if they don't have a physical office here. If you're offering an app to New Zealand users, you should treat New Zealand privacy compliance as part of your launch planning.

The Privacy Act is built around the information privacy principles, including the newer IPP3A obligation that applies from 1 May 2026 when an agency collects personal information indirectly from someone other than the individual concerned. For apps, this can be relevant where you collect information from connected devices, third-party integrations, partners, APIs, analytics tools or other sources.

For an app, the most relevant principles usually cover:

• Purpose: only collect personal information you need for a lawful business purpose.
• Collection: collect information directly from the user where practical, tell them what you're collecting and why, and consider whether IPP3A requires you to notify them when you collect their information indirectly.
• Use: use information for the purpose you collected it for, unless an exception applies.
• Storage and security: protect information against loss, unauthorised access and misuse through clear information security controls.
• Access and correction: let users access and correct their personal information where the Act requires it.
• Accuracy: take reasonable steps to make sure information is accurate before you use it.
• Retention: don't keep personal information longer than needed.
• Overseas disclosure: take care when disclosing personal information to overseas providers or related companies.

The Act also has a notifiable privacy breach scheme. If a privacy breach has caused, or is likely to cause, serious harm, you need to notify the Privacy Commissioner and affected people as soon as practicable.

A PIA helps you test these obligations against your actual app flows, not just your privacy policy wording.

What Should A Privacy Impact Assessment Plan Include?

Your PIA plan should describe what your app does, what data it collects, where the risks are and what you're doing to reduce those risks.

You don't need a 60-page document for every app. A lean, practical PIA can work well if it's specific and honest. A generic template may miss the real issue, such as background GPS tracking, third-party analytics, indirect collection from an API or training an AI model on user inputs. A lawyer should tailor your PIA before you rely on it for launch, especially if your app handles sensitive data.

As a starting point, your PIA outline could include:

1. App Overview: explain the app, main features, target users and launch markets.
2. Data Map: list each type of personal information collected, including device data, location data, user-generated content and information collected indirectly from connected devices, partners, social logins or APIs.
3. Purpose For Collection: state why each data type is needed and which feature depends on it.
4. User Notices And Consent: note where users are told about collection, including any IPP3A notice for indirect collection, and where you ask for consent or settings choices.
5. Data Flows: map where information comes from and where it goes, including cloud hosting, analytics tools, support tools and offshore providers.
6. Access Controls: explain who in your team can see the data and how access is limited.
7. Security Measures: record encryption, authentication, logging, testing and incident response steps.
8. Retention And Deletion: set how long data is kept and how users can delete accounts or request correction.
9. Risk Rating: rate each privacy risk by likelihood and impact.
10. Action Plan: list fixes, owners and deadlines before launch.

Keep your PIA alive after launch. If you add a new feature, connect a new analytics tool or start using AI in a new way, update the assessment rather than starting from scratch.

How Should I Assess Health, Location, Children's, Financial And AI Data?

You should assess these data types with extra care because misuse, over-collection or poor security can create real harm for users and your business.

Health App Privacy

If your app collects health information, check whether the Health Information Privacy Code 2020 applies and whether you need health data sharing terms. It can apply to health agencies, including some businesses that provide health services or handle health information in that context. Even if your app is more "wellness" than clinical, health-related information is still sensitive and deserves a higher level of care.

For example, Maya's wellness app originally planned to keep mood journal entries forever and use them to train future recommendation tools. Her PIA flagged that users may not expect that. The launch version changed to keep journal entries for 12 months by default, offer account deletion, and separate product analytics from raw journal text.

Location Data

Location data should usually be collected only when the feature genuinely needs it. If your app can work with suburb-level location, don't collect precise GPS. If live tracking is only needed during a delivery, don't track users in the background after the delivery ends.

Children's Data

New Zealand privacy law doesn't set one simple age cut-off for all apps. Your approach should reflect the child's age, maturity, the type of data and the risk. Use clear language, minimise collection, and think carefully about parental involvement where your app is aimed at children.

Financial And Automated Decision Data

If your app uses financial data or AI scoring, focus on transparency, accuracy and human review. A budgeting app that categorises spending is one thing. An app that automatically declines access, changes pricing, processes payments or ranks people based on financial behaviour needs stronger checks and clearer user explanations.

What App Privacy Documents Should I Have Before Launch?

You should have privacy documents that match how your app actually works, not just a broad privacy policy copied from another product.

Your privacy setup may include:

• Privacy Policy: the main document explaining how your business collects, uses, stores and shares personal information.
• Collection Notices: shorter notices at key moments, such as account sign-up, location permission requests, health questionnaire screens or where IPP3A requires notice about indirect collection.
• App Terms: rules for using the app, account security, acceptable use, subscriptions, disclaimers and suspension rights.
• Data Processing Or Supplier Agreements: contracts with developers, hosting providers, analytics platforms and support tools that handle personal information for you.
• Consent Wording: specific wording for optional features, sensitive data, marketing, cookies and sharing with selected third parties.
• Data Breach Response Plan: a practical plan for identifying, containing, assessing and notifying privacy breaches.
• Internal Access Policy: rules for who in your team can access user data and when.

Your privacy policy and collection notices should be consistent. If your privacy policy says you don't share data with overseas providers, but your app uses overseas cloud hosting or analytics, that mismatch can create trouble under the Privacy Act and the Fair Trading Act 1986. The Fair Trading Act matters because your public privacy statements are also representations to users.

For apps, your collection notices should also deal with indirect collection where relevant. For example, if you collect personal information from a wearable device, a social login provider, a partner system, a third-party API or analytics tool, your notice should explain this in a way users can understand, unless an exception applies.

If you charge users, offer in-app subscriptions or make claims about app performance, the Consumer Guarantees Act 1993 and Fair Trading Act may also affect how you describe the service. Privacy isn't the only compliance piece, but it's often the piece users and app reviewers notice first.

How Do I Run A Practical PIA Before Release?

You can run a practical PIA by treating it as part of your product build, rather than a legal document you prepare after everything is finished.

A useful process looks like this:

1. Map The User Journey: write down each screen where your app collects, creates or shares personal information.
2. List The Data: include obvious data like names and emails, plus less obvious data like device IDs, IP addresses, crash logs, analytics events and data received from third-party sources.
3. Challenge Each Data Point: ask whether the feature works without it, with less detail, or with shorter retention.
4. Check Third Parties: identify hosting, analytics, payment, AI, customer support and marketing tools that receive personal information, and any partners or integrations you collect information from.
5. Rate The Risks: focus on harm to users, likelihood of misuse, security weaknesses and reputational impact.
6. Choose Controls: add changes such as permission prompts, encryption, role-based access, deletion tools and clearer notices.
7. Record Decisions: keep a short record of what you changed, what you accepted and why.
8. Review Before Major Updates: repeat the process when you add sensitive features, new markets or new data uses.

For a simple example, say your food delivery app wants to show customers the courier's live location. Your PIA may decide to collect courier GPS every 30 seconds during an active delivery, stop tracking once the delivery is marked complete, and delete detailed route history after 30 days. That's more defensible than collecting continuous background location with no clear end point.

The aim isn't to remove every risk. It's to make sensible design choices and have a clear record of why they protect users while letting your app work properly.

Key Takeaways

• A PIA usually isn't mandatory for every New Zealand app, but it's a smart step where your app collects sensitive, high-volume or unexpected personal information.
• Location, health, children's, financial, biometric, indirect collection and automated decision-making data are strong triggers for a PIA.
• The Privacy Act 2020 applies to most apps collecting personal information from New Zealand users, and IPP3A can require notice when you collect information indirectly from other sources.
• Your PIA should map data flows, identify risks, record controls and feed directly into your app design, privacy policy and collection notices.
• Privacy documents should be tailored to your actual app, especially where you use overseas providers, AI tools, third-party analytics or integrations.

If you'd like help with your app privacy assessment, privacy policy, collection notices or supplier data terms, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.