New Zealand Act
It creates governance, accreditation marks, a public register, complaints and enforcement processes.
Plain-English explainers, not legal advice. Use the linked official source for section-level detail, and get advice for your situation.
Get legal helpQuick read
Likely relevant if
Check first
The Act creates a formal trust framework for digital identity services in New Zealand. It enables certain digital identity services and their providers to become accredited, identified as accredited, and monitored through a dedicated governance structure.
This framework aims to increase trust and security in digital identity transactions for individuals and organisations.
Practical sense check
The Act primarily targets accredited digital identity providers (TF providers) and the accredited services they offer. It also applies to relying parties - businesses or organisations that depend on information shared through accredited services.
Businesses that are not accredited providers but use digital identity services should understand the meaning and limits of accreditation. The Act prohibits anyone from falsely representing themselves or their services as accredited.
The Act becomes relevant at common business moments, not only during regulatory investigations. Key trigger points include launching identity products, applying for accreditation, updating service details, or responding to security or privacy incidents.
Practical sense check
Accredited providers must follow ongoing duties under the Act. They must only collect, use, or share personal or organisational information when authorised and in compliance with TF rules and regulations. Providers must maintain governance, records, and incident response processes that support the accredited service.
Practical sense check
The Act authorises the use of accreditation marks approved by the TF board to identify accredited services. The TF authority publishes terms of use for these marks, which providers must follow.
Businesses relying on accredited services should verify providers using the public register before integrating or promoting their services.
The Act provides a complaints process, dispute resolution scheme, and investigation powers for the TF authority. Remedies for breaches include public warnings, additional record-keeping or reporting requirements, compliance orders, suspension, or cancellation of accreditation.
The Act creates offences with penalties for misrepresenting accreditation status, providing false information, or obstructing the TF authority.
Practical sense check
For small or growing providers, governance weaknesses such as inaccurate accreditation claims, poor change notification, or incomplete records pose the greatest risk. These issues can escalate to enforcement actions or offences.
No. The Act does not ban non-accredited digital identity services but prohibits misrepresenting them as accredited.
Individuals can be fined up to $50,000 and bodies corporate up to $200,000 for misuse or false representation related to accreditation marks.
The Act comes into force on dates set by Order in Council, or if not brought into force earlier, on 1 July 2024.
No. The Privacy Act 2020 continues to apply alongside the Digital Identity Services Trust Framework Act.
Accredited providers must notify the TF authority of changes to key or specified information as required by the Act.