Interconnection with, and pricing for access to, networks are regulated under Schedule 1 of the Telecommunications Act 2001. The current information disclosure regime for regulated fibre service providers is mainly set out in Part 6 of the Telecommunications Act 2001, particularly Arts. 187–188, and applies to the companies providing regulated fibre fixed line access services, including Chorus. These companies are required to comply with Commerce Commission information disclosure determinations, which may include annual disclosure requirements, assurance requirements, certificates or statutory declarations, and data retention obligations.

The Telecommunications (Interception Capability and Security) Act 2013 creates upon a network operator 1) a duty to implement full interception capability (Section 9) and 2) a duty to assist a surveillance agency upon an inception warrant or any other lawful interception authority (Section 24). In order to comply with the assistance duty, a network operator must decrypt telecommunication on that operator’s public telecommunications network or telecommunications service "if (a) the content of that telecommunication has been encrypted; and (b) the network operator intercepting the telecommunication has provided that encryption."
However, this does not require a network operator to "(a) decrypt any telecommunication on that operator’s public telecommunications network or telecommunications service if the encryption has been provided by means of a product that is (i) supplied by a person other than the operator and is available to the public or (ii) supplied by the operator as an agent for that product; and (b) ensure that a surveillance agency has the ability to decrypt any telecommunication.
Nevertheless, the existence of these duties, taken together, practically means that network operators cannot design and implement end-to-end encryption. A joint communique called International Statement - End-to-End Encryption and Public Safety - expressed concern about the challenges that end-to-end encryption will pose to law enforcement but at the same time acknowledged privacy, cybersecurity, and intellectual property protection. The government stated that it is committed to collaborating with the industry to develop "reasonable proposals" on this issue.

New Zealand has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

It has been reported that New Zealand lacks a telecommunications authority whose decision-making process is entirely independent of government influence. The Ministry of Business, Innovation and Employment (MBIE) is responsible for shaping the telecommunications regulatory framework, including establishing rules governing the operations of telecommunications companies and ensuring product compliance. In addition, the New Zealand Commerce Commission plays a key role in overseeing competition within the telecommunications sector and regulating certain services. It holds the authority to recommend whether services should be regulated or deregulated. As an independent statutory body, the Commission is tasked with enforcing the Commerce Act and is primarily accountable to the Minister of Commerce and Consumer Affairs for its operational performance and outcomes. The Commission may also set terms and conditions, including pricing, for regulated services through Standard Terms Determinations. Furthermore, it possesses the power to mandate the availability of industry-wide services, such as number portability, impose information disclosure obligations, and implement structural remedies, including the separation of services. Although the Commerce Commission operates independently, the Minister for Communications retains the authority to accept or reject the Commission's recommendations on regulating or deregulating services. Additionally, the Minister may issue a "statement of economic policy," which the Commission must consider in its decision-making.

Sections 354 and 355 of the Customs and Excise Act stipulate that businesses engaged in importing or exporting to or from New Zealand must retain prescribed records within New Zealand, unless authorised by the chief executive of the New Zealand Customs Service to do so elsewhere.

Since its enactment in 2013, Sections 215 and 216 of the Financial Markets Conduct Act 2013 have required issuers of financial products to keep a register of their regulated products in New Zealand, even when it is in electronic form. In addition, Sections 455 and 456 require reporting entities, such as issuers of financial products, registered banks, building societies, and credit unions, to keep certain accounting records in New Zealand.
Under Section 458, accounting records, or copies of them, must be retained by the financial market conduct reporting entity for at least 7 years after the later of (a) the date the records are made and (b) the date of completion of the transaction to which the records relate.
Despite this local storage requirement, the Act allows reporting entities to keep accounting records outside New Zealand if specific documents are kept in New Zealand, such as the financial statements of any reporting entity and any registered scheme it manages, and any document annexed to those financial statements that provides legally required information (Section 456). The Act does not otherwise prohibit cross-border data transfers.

Under Section 22.2BA of the Tax Administration Act (TAA) and Section 75.3BA of the Goods and Services Tax Act (the GST Act), taxpayers in New Zealand are legally required to retain business and GST records within the country, whether in physical or electronic form. However, the Commissioner of Inland Revenue (CIR) may, under Section 22.8 of the TAA and Section 75.6 of the GST Act, exercise discretion to authorise offshore storage of such records. According to Revenue Alert 10/02, the CIR maintains that compliance with statutory record-keeping obligations necessitates the physical storage of primary business records in data centres located within New Zealand. Consequently, taxpayers using cloud computing services must ensure that their primary records are stored domestically, although the use of offshore cloud services for backup purposes is permissible, provided the primary records remain in New Zealand.

Section 189 of the Companies Act stipulates that companies must retain the following records at their registered office in New Zealand: the company’s constitution; resolutions and minutes of meetings of directors and shareholders; all written communications to shareholders and any share certificates issued; the register of directors; the register of directors’ interests; directors’ certificates; the share register; and the company’s financial statements together with its tax and accounting records.

The new Privacy Act 2020, which entered into force in December 2020, creates a conditional flow regime. Information Privacy Principle 12 in Section 22 of the Act governs cross-border data transfer. A business or organisation may only disclose personal information to another organisation outside New Zealand if the receiving organisation:
- is subject to the Privacy Act because they do business in New Zealand;
- is subject to privacy laws that provide comparable safeguards to the Privacy Act - or they agree to protect the information in such a way (e.g., by using model contract clauses), or
- is covered by a binding scheme or is subject to the privacy laws of a country prescribed by the New Zealand Government.
If none of these conditions is satisfied, a business may only make a cross-border disclosure with the permission of the data subject.
This regime does not apply to an overseas organisation that holds or processes on the business's behalf (e.g., cloud service providers).
Still, despite the IPP 12, a business may make a cross-border disclosure in urgent circumstances where it is necessary to maintain public health or safety or for the maintenance of the law.
This regime does not affect or limit other New Zealand law that regulates the availability of personal information (Section 24).

New Zealand has joined several agreements with binding commitments to open transfers of data across borders. These include: the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP, Art. 14.11), the Protocol to Amend the Agreement between Singapore and New Zealand on a Closer Economic Partnership (Art. 9.10), the Digital Economy Partnership Agreement Between Singapore, Chile and New Zealand (DEPA, Art. 4.3), the Free Trade Agreement between the United Kingdom of Great Britain and Northern Ireland and New Zealand [Art.15.4(2)], the EU-New Zealand Free Trade Agreement (Chapter 12, Art. 12.4), and the Protocol to the Digital Economy Partnership Agreement (Art. 5)

The Privacy Act 2020 provides a comprehensive data protection regime in New Zealand. It repeals and replaces the Privacy Act 1993 and contains 13 Information Privacy Principles (IPP) that govern the use of personal information in the country. The Act requires agencies to appoint at least one privacy officer, report data breaches that cause or are likely to cause serious harm, and provide data subjects with both the right to access and the right to request correction of their personal information. In addition, the new IPP 12 provides that an organisation or business may disclose personal information to an agency outside New Zealand only if the receiving agency is subject to safeguards similar to those in the Act. Also, the Act introduces new criminal penalties, punishable with fines of up to NZD 10,000 (approx. USD 6,000) and allows the Office of the Privacy Commissioner of New Zealand to issue compliance notices and enforceable access directions.

The Privacy Act 2020 provides that "[a]n agency must appoint as privacy officers for the agency one or more individuals" (Section 201).

Trade secrets are not protected under a dedicated statutory civil regime in New Zealand, but they may be protected through contractual arrangements and common law actions for breach of confidence. Under Section 230 of the Crimes Act 1961, the misappropriation of a trade secret, with intent to obtain a financial or economic advantage or to cause loss to another person, constitutes a criminal offence punishable by up to five years’ imprisonment. In addition, Section 249 criminalises accessing a computer system for a dishonest purpose to obtain property, which may apply to digital files and is punishable by up to seven years’ imprisonment.
Confidential commercial information held by public authorities may also be protected from disclosure under the Official Information Act 1982, including where disclosure would reveal trade secrets or prejudice commercial interests.

It is reported that New Zealand imposes passive infrastructure-sharing obligations to support the delivery of telecommunications services to end users.

The New Zealand Government has retained ownership interests in certain telecommunications companies since at least 2004 through Kordia’s predecessor, Transmission Holdings Limited. Kordia Group Limited, under its current name, has been listed as a state-owned enterprise since 22 March 2007, when it replaced Transmission Holdings Limited in the relevant state-owned enterprise schedule.
Kordia provides a range of services, including the transmission and linking of telecommunications and broadcasting signals, the design, construction, operation, and maintenance of transmission networks, as well as cybersecurity, cloud, connectivity, broadcast, and maritime safety services.