New Zealand Act
The Customer and Product Data Act 2025 creates New Zealand's framework for customer-controlled data sharing.
Plain-English explainers, not legal advice. Use the linked official source for section-level detail, and get advice for your situation.
Get legal helpQuick read
Likely relevant if
Check first
The Act creates the legal framework for a New Zealand customer data right. In a designated sector, a customer may be able to ask a data holder for specified data, authorise an accredited requestor to obtain it, or ask for a designated action to be performed.
The framework is intended to support services such as comparison, switching and account management. The Act supplies the legal structure, while designation regulations and standards determine much of the practical scope.
Check coverage
Confirm that the data holder, customer, data and requested service fall within the designation and rules.
Verify the person
Apply the required identity checks for the customer, secondary user or accredited requestor.
Confirm authorisation
Where an accredited requestor is involved, make sure customer authorisation is valid, controllable and capable of being ended.
Provide or refuse lawfully
Deliver the regulated service through the compliant system or rely on a permitted or required refusal ground.
Keep the record
Retain the records needed to explain what was requested, authorised and provided.
Compliance will show up in the product itself. Authorisation language, identity checks, revocation controls, API performance, security and complaint routes all shape whether the service works lawfully.
A legal policy cannot repair a confusing or insecure customer journey after launch. Product, engineering, privacy, security and customer-support teams need one implementation plan.
Key points
Key points
No. The main regulated data-service duties depend on designation regulations that identify sectors, data holders, data and actions. A business should check its role and the relevant designation before assuming it is covered.
It is a person approved under the Act to request regulated data services with a customer's authorisation. Accreditation can carry terms, conditions, renewal requirements and ongoing compliance duties.
No. Privacy and security are central, but the Act also covers data access, designated actions, accreditation, technical standards, complaints, enforcement and civil remedies.
Customer and Product Data Act guide added
The library now explains New Zealand's customer-controlled data-sharing framework, including designation, authorisation, data-holder and accredited-requestor roles.