The law already covers AI
New Zealand does not, at the time of writing, have a separate AI law for businesses. The Privacy Act 2020 and its information privacy principles apply to personal information whatever technology handles it. The Office of the Privacy Commissioner has published guidance on generative AI and has made clear it expects organisations to apply the existing principles. Read that guidance directly, because it is updated and this article can only summarise in general terms. Personal information means anything about an identifiable person: a client's name and email, a staff member's leave history, a customer's purchase record, a recording of a voice. If it goes into an AI tool, or an AI tool produces it, the Privacy Act is relevant.
Purpose and expectation
Under the Act, personal information should generally be used for the purpose it was collected for, or a directly related one. A customer who gave their details to book a service would probably expect them to be used for the booking and follow-up, but not to be pasted into a third-party AI tool to build a marketing profile. Ask whether the people involved would be surprised by how their information is being used. Your privacy statement should reflect how you actually use information. If you start using AI to analyse customer enquiries or transcribe calls, consider whether your privacy statement and the notices you give people need updating to say so.
Security and disclosure
Businesses must take reasonable steps to protect personal information from loss, misuse and unauthorised disclosure. Entering client details into a free AI tool whose terms let the provider retain and use the content may not meet that standard. Using a business-grade tool with appropriate data terms, access controls and company sign-in is a more defensible choice.
Where an AI provider stores or processes information only on your behalf, your business generally stays responsible for it. Where information is disclosed to an overseas organisation for its own purposes, cross-border rules apply. Understanding the provider's terms tells you which situation you are in, and many AI services process data outside New Zealand.
Accuracy matters more with AI
The Act expects businesses to take reasonable steps to check personal information is accurate before using it. AI tools can produce wrong statements about people, mix up records or infer things that are not true. If an AI summary of a customer file says they missed payments when they did not, and you act on that, the error is yours. Keep a person responsible for any decision that affects someone, such as declining credit, choosing between job applicants or handling a complaint. Use AI to assist, then have someone check the facts against the source records before acting.
Access, correction and transparency
People have the right to ask what personal information you hold about them and to request corrections. If AI tools generate summaries, notes or profiles about people and you keep them, those may be part of what you hold. Know where AI outputs are stored so you can find them if a request arrives. Being open is good practice and reduces complaints. Tell people when calls are transcribed by AI, when an AI chat is answering enquiries, or when AI helps assess applications. People generally accept sensible uses that are explained to them; they object to discovering them later.
Breaches involving AI
If personal information is exposed through an AI tool, for example confidential client details shared in a way that becomes public, or an AI assistant revealing staff records to colleagues who should not see them, treat it as a potential privacy breach. If a breach is likely to cause serious harm, the Act requires you to notify the Privacy Commissioner and affected people as soon as practicable. Prepare by deciding in advance who assesses a possible breach and how. Include AI scenarios in your incident plan, and record what tools are in use, which data they can reach and who approved them.
A short checklist
Know which AI tools are in use and what personal information they touch. Use business-grade tools with suitable data terms and sign-in security. Keep personal information out of unapproved tools. Check AI output about people before acting on it. Update your privacy statement to describe AI use. Store AI outputs about people where you can find them. If you are uncertain about a specific use, especially involving health, financial or children's information, take advice from a privacy professional or lawyer before going ahead.
In short
- The Privacy Act 2020 applies to AI just like any other system handling personal information.
- Use personal information in AI only in ways people would reasonably expect.
- Check AI output about people before acting on it; errors are your responsibility.
- Update your privacy statement and be open with people about AI use.