New Zealand EU Representative

Does GDPR Apply to New Zealand Companies?

Yes. Despite New Zealand being one of only 13 countries with an EU adequacy decision for data transfers, this does not exempt NZ companies from GDPR compliance. The adequacy decision means EU data can flow freely to NZ — but if you process EU personal data as a data controller or processor, you still must comply with GDPR’s substantive requirements, including Article 27’s mandate to appoint an EU Representative.

Many New Zealand businesses incorrectly believe the EU adequacy decision covers all GDPR obligations. It doesn’t. Adequacy addresses cross-border data transfers (Chapter V), not the full GDPR framework. If your NZ business offers goods or services to EU residents, monitors their behaviour, or processes their personal data, you are a data controller under GDPR, and you need an EU Representative.

New Zealand Privacy Act vs GDPR

The Privacy Act 2020 is a modern, well-regarded privacy framework with 13 Information Privacy Principles. However, key gaps remain:

• No mandatory breach notification: Privacy Act has no 72-hour notification requirement (GDPR Article 33)
• No mandatory DPO: Not required under NZ law
• No Article 27 equivalent: Privacy Act does not require a local representative for non-NZ entities
• Different enforcement: NZ Privacy Commissioner can issue compliance notices but fines are capped vs GDPR’s 4% of turnover
• Limited extraterritorial scope: Privacy Act applies to NZ agencies; GDPR explicitly targets non-EU businesses serving EU data subjects

NZ Industries Most Exposed

Tourism & hospitality: NZ tourism businesses marketing to EU travellers. Booking data, guest information, and marketing databases all process EU personal data.

E-commerce: NZ online retailers shipping to EU customers. Every transaction involves personal data processing under GDPR.

SaaS & tech: NZ software companies with EU users. Analytics, support, billing — all trigger GDPR.

Agriculture & export: NZ food and agricultural exporters with EU distributors. B2B contact data of EU buyers, logistics partners, and regulatory contacts.

3-Step Compliance

1. Appoint EU Shield — EU legal address and service of process acceptance
2. Update Privacy Policy — add EU Representative section; template provided
3. Maintain ROPA — record processing activities per Article 30

See Pricing →