New Zealand’s privacy regime expects businesses to handle personal information fairly and securely. For a typical SME website, the practical focus is: what you collect via forms, what analytics/marketing tags run, how you store enquiries, and how you respond if someone asks what you hold about them.
What counts as personal information?
Names, emails, phone numbers, addresses, and anything that can identify a person—often including IP-derived data depending on configuration. Treat form submissions and customer accounts as information you must protect.
What should your privacy statement cover (at minimum)?
- What you collect and why.
- Who you share it with (e.g., email marketing tool, CRM).
- How long you keep it.
- How people can contact you about access/correction.
- Security measures at a high level (not exposing internal secrets).
How should you think about cookies and analytics?
Not all analytics are equal. Some tools lean on cookies and advertising identifiers. Your obligations depend on what you deploy and how you explain it. Many NZ SMEs start with privacy-preserving configurations and clear notices, then tighten as they add remarketing.
What are pragmatic operational habits?
- Minimise data: ask only for fields you need.
- Restrict admin accounts and enable MFA.
- Do not store credit card data unless you are PCI-compliant (usually you should not).
- Have a process for data breaches (even a simple runbook).
Does your web partner matter here?
Yes—misconfigured forms, leaky plugins, and sloppy tracking deployments create risk. If you want a NZ team that builds business sites with sensible defaults, start at NZDH and bring privacy questions early.
Frequently asked questions
Do I need a cookie banner?
Depends on what you run and your legal advice. Many sites use banners to disclose non-essential cookies; the right approach varies.
Can I use Google Analytics?
Often yes, with configuration and disclosure considerations. Review current product terms and your advisor’s guidance.
What if I only have a contact form?
You still handle personal information. Secure email delivery, limit retention, and document basics.
Privacy Act 2020 and your website
The Office of the Privacy Commissioner oversees how NZ organisations collect and use personal information. Contact forms, newsletters, analytics cookies, and booking tools all collect data—you need a clear privacy notice explaining what you collect, why, how long you keep it, and who you share it with.
This is general guidance, not legal advice; regulated sectors (health, finance) should consult professionals. Align your public privacy policy page with actual practice.
Cookies, analytics, and consent
Google Analytics 4 and advertising tags may require consent depending on configuration and guidance from the Commissioner. Document your choices; use consent mode where appropriate. See our guides on privacy notices vs cookie banners and consent mode overview.
More guides in this topic
- Privacy notices vs cookie banners: what customers expect to see
- Marketing consent and record-keeping: plain-English primer for SMEs
- Handling privacy access requests with a small team playbook
- Data retention: how long should enquiry forms live in your inbox?
- Subprocessors and SaaS tools: what to disclose responsibly
Browse the full Privacy & compliance guide hub or return to the guides home.
Explore on NZDH.co.nz
- All practical guides
- Website design services
- SEO services
- Recent website projects
- Frequently asked questions
Authoritative further reading
These independent resources complement this guide. Search engines and customers both reward accurate, helpful information—we link out where official documentation or regulators explain the topic better than a generic blog post could.