When does the GDPR actually apply to New Zealand companies?
In conversations with New Zealand organisations about their privacy programme, one theme comes up again and again: “We’re using a processor in Europe, so the GDPR must apply to us.”
The European Data Protection Board (EDPB) has been explicit in its territorial scope guidance (Guidelines 3/2018): simply using an EU-based processor does not mean that GDPR applies unless other conditions are met. Your vendor being based in Germany or Ireland doesn’t mean your organisation is “established” in Europe under Article 3(1), in contrast your staff based in these countries may meet the definition of “established”.
In New Zealand organisations are usually in scope for GDPR as a controller due to:
Targeting people in the EU. If your organisation is offering goods or services (whether free or paid) to individuals located in the EU, GDPR applies. For example, a Wellington SaaS company marketing to German businesses and onboarding German clients.
Monitoring people in the EU. If you are observing behaviour of individuals in the EU through profiling, tracking browsing, or running detailed analytics GDPR applies, regardless of your location. For example, an Auckland health-tech startup running behavioural analytics on app users in Spain.
Some organisations over-engineer privacy programmes, burning resource on GDPR obligations that don’t apply rather than focusing attention on the New Zealand obligations that apply. Whilst others assume GDPR doesn’t matter because “we’re in New Zealand”, while in fact they are directly targeting the EU market and carrying real regulatory exposure.
Privacy is not about ticking boxes or reflexively copying what others do. It’s about understanding the intent of legal frameworks and applying them to your own organisation’s context with nuance.
Reach out and talk to one of our team to understand if GDPR applies to your organisation.