The new Privacy Act 2020, which entered into force in December 2020, creates a conditional flow regime. Information Privacy Principle 12 in Section 22 of the Act governs cross-border data transfer. A business or organisation may only disclose personal information to another organisation outside New Zealand if the receiving organisation:
- is subject to the Privacy Act because they do business in New Zealand;
- is subject to privacy laws that provide comparable safeguards to the Privacy Act - or they agree to protect the information in such a way (e.g., by using model contract clauses), or
- is covered by a binding scheme or is subject to the privacy laws of a country prescribed by the New Zealand Government.
If none of these conditions is satisfied, a business may only make a cross-border disclosure with the permission of the data subject.
This regime does not apply to an overseas organisation that holds or processes on the business's behalf (e.g., cloud service providers).
Still, despite the IPP 12, a business may make a cross-border disclosure in urgent circumstances where it is necessary to maintain public health or safety or for the maintenance of the law.
This regime does not affect or limit other New Zealand law that regulates the availability of personal information (Section 24).

New Zealand has joined several agreements with binding commitments to open transfers of data across borders. These include: the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP, Art. 14.11), the Protocol to Amend the Agreement between Singapore and New Zealand on a Closer Economic Partnership (Art. 9.10), the Digital Economy Partnership Agreement Between Singapore, Chile and New Zealand (DEPA, Art. 4.3), the Free Trade Agreement between the United Kingdom of Great Britain and Northern Ireland and New Zealand [Art.15.4(2)], the EU-New Zealand Free Trade Agreement (Chapter 12, Art. 12.4), and the Protocol to the Digital Economy Partnership Agreement (Art. 5)

The Privacy Act 2020 provides a comprehensive data protection regime in New Zealand. It repeals and replaces the Privacy Act 1993 and contains 13 Information Privacy Principles (IPP) that govern the use of personal information in the country. The Act requires agencies to appoint at least one privacy officer, report data breaches that cause or are likely to cause serious harm, and provide data subjects with both the right to access and the right to request correction of their personal information. In addition, the new IPP 12 provides that an organisation or business may disclose personal information to an agency outside New Zealand only if the receiving agency is subject to safeguards similar to those in the Act. Also, the Act introduces new criminal penalties, punishable with fines of up to NZD 10,000 (approx. USD 6,000) and allows the Office of the Privacy Commissioner of New Zealand to issue compliance notices and enforceable access directions.

The Privacy Act 2020 provides that "[a]n agency must appoint as privacy officers for the agency one or more individuals" (Section 201).

Trade secrets are not protected under a dedicated statutory civil regime in New Zealand, but they may be protected through contractual arrangements and common law actions for breach of confidence. Under Section 230 of the Crimes Act 1961, the misappropriation of a trade secret, with intent to obtain a financial or economic advantage or to cause loss to another person, constitutes a criminal offence punishable by up to five years’ imprisonment. In addition, Section 249 criminalises accessing a computer system for a dishonest purpose to obtain property, which may apply to digital files and is punishable by up to seven years’ imprisonment.
Confidential commercial information held by public authorities may also be protected from disclosure under the Official Information Act 1982, including where disclosure would reveal trade secrets or prejudice commercial interests.

It is reported that New Zealand imposes passive infrastructure-sharing obligations to support the delivery of telecommunications services to end users.

The New Zealand Government has retained ownership interests in certain telecommunications companies since at least 2004 through Kordia’s predecessor, Transmission Holdings Limited. Kordia Group Limited, under its current name, has been listed as a state-owned enterprise since 22 March 2007, when it replaced Transmission Holdings Limited in the relevant state-owned enterprise schedule.
Kordia provides a range of services, including the transmission and linking of telecommunications and broadcasting signals, the design, construction, operation, and maintenance of transmission networks, as well as cybersecurity, cloud, connectivity, broadcast, and maritime safety services.

It is reported that New Zealand does not mandate accounting separation for operators with significant market power (SMP) in the telecom market. However, under the Telecommunications Act, functional separation is mandated for operators with significant market power.

Interconnection with, and pricing for access to, networks are regulated under Schedule 1 of the Telecommunications Act 2001. The current information disclosure regime for regulated fibre service providers is mainly set out in Part 6 of the Telecommunications Act 2001, particularly Arts. 187–188, and applies to the companies providing regulated fibre fixed line access services, including Chorus. These companies are required to comply with Commerce Commission information disclosure determinations, which may include annual disclosure requirements, assurance requirements, certificates or statutory declarations, and data retention obligations.

In March 2023, New Zealand's Parliamentary Service announced a ban on TikTok across all devices connected to the parliamentary network, citing cybersecurity concerns. The decision followed internal analysis and consultations with both domestic and international partners, which concluded that the app posed security risks within the parliamentary environment. The ban affects around 500 individuals, though exemptions may be granted for those who require the app for official functions. This measure aligns New Zealand with other Western nations that have implemented similar restrictions on TikTok due to data security concerns.

Under Rule 8 of the Government Procurement Rules (5th edition), public agencies evaluating goods and services procurements above NZD 100,000 (approx. USD 59,000) must reserve at least 10% of the evaluation score for benefits to the New Zealand economy. These benefits may include using New Zealand workers, businesses, SMEs, regional suppliers, subcontractors, or supply chains, or contributing to the development of New Zealand industry capability. For procurements below this threshold, agencies are generally expected to award contracts to capable New Zealand businesses, unless there is a good reason not to. For this rule, New Zealand businesses include Australian businesses.

New Zealand is a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA), and its commitments also cover the services sectors considered most important for digital trade, namely telecommunication services (CPC 752), telecommunication-related services (CPC 754), and computer and related services (CPC 84).

There are no foreign ownership limitations in sectors relevant to digital trade.

According to Section 10 of the Companies Act 1993 (introduced in May 2015 by the Companies Amendment Act 2015), any company incorporated in New Zealand is required to have at least one director living in New Zealand or living in an 'enforcement country' and is a director of a company that is registered in that enforcement country. Per Section 12 of the Companies Act Regulations 1994, the only enforcement country currently named in the regulations is Australia. The residency requirement does not apply to a branch of an overseas company registered in New Zealand that merely "carries on business" in New Zealand, as defined in Section 332 of the Companies Act.

New Zealand applies foreign investment screening under the Overseas Investment Act 2005. Under Arts. 10 and 11: overseas investors must obtain consent before making investments in sensitive New Zealand assets, including significant business assets. Under Art. 13, an overseas investment in significant business assets includes the acquisition of rights or interests in securities where the overseas person obtains more than 25% ownership or control, or increases an existing interest above that threshold, and where the value of the securities, consideration, or relevant assets exceeds NZD 100,000 (approx. USD 59,000), unless an alternative monetary threshold applies. Under Arts. 18 and 18A, consent for significant business assets requires satisfaction of the investor test, which assesses whether the investor is unsuitable to own or control sensitive New Zealand assets based on character and capability factors.
The regime was amended by the Overseas Investment (Urgent Measures) Amendment Act 2020, which introduced the national interest framework under Arts. 20A–20C and the national security and public order call-in regime under Part 3. Accordingly, transactions involving non-New Zealand government investors or strategically important businesses, including telecommunications infrastructure, media businesses, military or dual-use technology, critical direct suppliers, and certain financial infrastructure, may be reviewed, and consent may be declined where the transaction is contrary to New Zealand’s national interest. In addition, call-in transactions involving strategically important business assets may be blocked, made subject to conditions, or unwound where they pose significant national security or public order risks.
In addition, in December 2025, New Zealand enacted the Overseas Investment (National Interest Test and Other Matters) Amendment Act 2025, which further amended the Overseas Investment Act 2005 by consolidating the national interest, benefit to New Zealand, and investor tests into a single national interest-based pathway. It also requires the regulator to grant consent within 15 working days, unless national-interest risks are identified.