Terms & Conditions Generator New Zealand
The Privacy Act 2020, thirteen information privacy principles, IPP12 on offshore transfers, and the Consumer Guarantees Act.
New Zealand terms sit under the Consumer Guarantees Act and the Fair Trading Act, and the Fair Trading Act in particular makes misdescribing a consumer’s rights an offence in its own right rather than merely an unenforceable clause.
New Zealand’s Privacy Act 2020 replaced the 1993 Act and introduced mandatory notification of privacy breaches, compliance notices, and IPP12 - a cross-border disclosure rule requiring you to be satisfied the overseas recipient will protect the information to a comparable standard.
The Act applies to every agency handling personal information, with no turnover threshold. That is a meaningful difference from Australia, where businesses under AUD 3 million are largely outside the regime.
On the consumer side, the Consumer Guarantees Act and Fair Trading Act give statutory rights that cannot be contracted out of in consumer transactions, and misrepresenting them is itself a breach the Commerce Commission enforces.
What a terms and conditions in New Zealand has to cover
Consumer guarantees stated as non-excludable in consumer transactions
Any business-to-business contracting out, which is permitted only where both parties are in trade and it is fair and reasonable
Accurate pricing and availability claims, with no misleading representations
Cancellation, delivery and remedy processes
How New Zealand actually moves personal data
Offshore hosting and SaaS
Most New Zealand businesses use Australian or US infrastructure, which is a cross-border disclosure engaging IPP12 rather than an ordinary sub-processing arrangement.
Customer records and access requests
IPP6 gives individuals a right of access with a twenty-working-day response requirement.
Marketing lists
Governed by the Unsolicited Electronic Messages Act separately from the Privacy Act.
Employee information
Covered by the same principles, with additional obligations where the information is used in employment decisions.
Breach assessment
The serious-harm test drives whether a breach is notifiable, and the assessment has to happen quickly enough to notify as soon as practicable.
Third parties the draft will ask you about
Stripe · Xero · NZ Post · AWS ap-southeast-2 · Vend or Shopify · Mailchimp
The rules that apply
Privacy Act 2020 and the 13 IPPs
Collection, use, disclosure, storage, access and correction principles, applying to every agency regardless of size.
IPP12 cross-border disclosure
Before sending personal information overseas you must be satisfied the recipient is subject to comparable safeguards, or rely on a listed exception.
Notifiable privacy breaches
Breaches causing or likely to cause serious harm must be notified to the Privacy Commissioner and affected individuals as soon as practicable.
Consumer Guarantees Act
Non-excludable guarantees on goods and services in consumer transactions.
Unsolicited Electronic Messages Act
Consent, identification and unsubscribe requirements for commercial electronic messages.
What the generated terms and conditions contains
Who the contract is with and how it is formed
Your legal entity, and the exact moment acceptance happens - account creation, checkout, or continued use.
The service, the licence and its limits
What you are actually providing, what the user may do with it, and what they may not.
Price, payment, renewal and cancellation
Billing cycle, auto-renewal, price-change notice, and how either side ends the arrangement.
Acceptable use and enforcement
The behaviour that gets an account suspended, and the process you follow before you suspend it.
User content and intellectual property
Who owns what, the licence you need to run the service, and the takedown route for infringing material.
Warranties, liability and indemnity
Disclaimers that survive local consumer law, and caps that are actually enforceable rather than theatrically broad.
Governing law, jurisdiction and disputes
The law that applies, the courts that hear it, and any pre-litigation steps you require.
New Zealand compliance essentials
Document your IPP12 position per offshore recipient
What safeguards apply, and which exception you rely on if none do.
Publish a privacy statement covering all thirteen principles
Including collection purpose, access and correction, and complaints.
Build the twenty-working-day access workflow
With identity verification and a record of each request.
Write the breach assessment runbook
Applying the serious-harm test and the notification route to the Privacy Commissioner.
State consumer guarantees before your own terms
And never describe them as excluded.
Where this usually goes wrong
Treating offshore hosting as ordinary processing
IPP12 requires you to be satisfied about the recipient’s protections before disclosing, and to be able to explain why.
Assuming a small-business exemption
There is none. The Privacy Act applies to every agency.
Missing the twenty-working-day access deadline
It is a statutory timeframe with a complaint route attached.
Contracting out of consumer guarantees
Void in consumer transactions and independently actionable as a misrepresentation.
No breach assessment process
The serious-harm test cannot be applied retrospectively at leisure - notification is required as soon as practicable.
Frequently asked questions
Does the Privacy Act apply to small businesses in New Zealand?
Yes. Unlike Australia, there is no turnover threshold - the Act applies to every agency that handles personal information.
Can I use overseas cloud services?
Yes, but IPP12 requires you to be satisfied the recipient is subject to comparable safeguards before disclosing, or to rely on a listed exception such as the individual’s informed authorisation.
How quickly must I answer an access request?
As soon as reasonably practicable and no later than twenty working days after receiving it.
Are terms and conditions legally binding?
They are when the user had a genuine opportunity to read them and took a positive step to accept. Clickwrap - a ticked box next to a visible link - holds up far more reliably than a "by using this site you agree" line in the footer.
What is the difference between terms of service and terms and conditions?
Nothing substantive. "Terms and conditions" is the more common phrasing in the UK and Commonwealth markets, "terms of service" in the US and in SaaS. The clauses do the same job.
Can I limit my liability to zero?
No. Most consumer regimes void attempts to exclude liability for death, personal injury or fraud, and unfair-terms rules strike out caps a court considers unreasonable. A cap that is drafted to survive review is worth more than one that is struck out entirely.
Do I need terms if I sell nothing?
If users can register, post, comment or upload, yes - the terms are what let you moderate, suspend and remove content without being in breach of contract yourself.
Terms & Conditions Generator New Zealand
Answer a short questionnaire and get a draft written for New Zealand. Free to start, no card required.
Generate your terms and conditionsOther documents for New Zealand
Each one is written for the same context, not a generic template.
The same document, by country
Go deeper
PolicifyAI is a technology provider, not a law firm, and this page is not legal advice. Generated documents are a structured starting point that a qualified adviser should review before you publish or rely on them.