Privacy Act 2020 — children and young people
Privacy obligations for children's information in New Zealand
Information about children requires extra care. The Privacy Act applies fully to children — and children are a vulnerable group requiring heightened protection. Here's what organisations must do.
📋 Privacy Act 2020 — information about children and young people
The Privacy Act applies to children
There is no minimum age for privacy rights in NZ. Children have the same rights as adults under the Privacy Act — including the right to access their own information and to request correction. As children mature, their ability to exercise these rights independently increases.
Why children's information requires extra care
Children are a vulnerable group
The Privacy Commissioner recognises that children are more vulnerable than adults and may not fully understand:
- What information is being collected about them
- How it will be used or shared
- The long-term consequences of data collection (e.g. social media posts that persist into adulthood)
- Their rights to access, correct, or request deletion
Organisations dealing with children should apply a higher standard of care — collecting the minimum necessary, storing it securely, and being transparent with parents and the children themselves.
Parental consent
When a parent's consent is needed
NZ law does not set a specific age below which parental consent is always required for data collection. The question is whether the child has capacity to understand what they are consenting to. For younger children (roughly under 13), parental consent for data collection is generally expected. For teenagers, the child themselves may be able to consent depending on the nature of the information.
For health information about children, health providers must carefully assess whether the child or the parent has authority to access the information — this depends on the child's competence and the nature of the information.
ECE and school settings
Strict obligations on photos, videos, and personal records
- Obtain parental consent before photographing or videoing children
- Only use images for the consented purpose — not on public social media without specific consent
- Student/child records must be kept secure and only shared with authorised persons
- Parents have the right to access their child's records
- If there is a dispute between parents (e.g. custody situation), careful legal advice may be needed before disclosing
Online services targeting children
Higher obligations apply
If you operate an online service that targets or is likely to be accessed by children, you should:
- Collect the minimum information necessary
- Use clear, child-friendly language in privacy notices
- Not use dark patterns to obtain consent
- Provide easy-to-use mechanisms for parents to review, correct, or delete their child's information
- Not use children's data for targeted advertising without explicit consent
Source: Privacy Act 2020; Privacy Commissioner guidance. Privacy Commissioner:
privacy.org.nz. General information only.
Frequently asked questions
Can a child access their own medical records?
Yes — if they have the capacity to understand what they are requesting and what the information means. Health providers should assess capacity individually. For a teenager who independently sought treatment for a sensitive matter, they may have the right to access those records without parental involvement.
Can parents access all of their child's records?
Generally yes for young children. For teenagers, particularly regarding sensitive matters like sexual health, mental health, or substance use, there may be reasons not to disclose to parents — particularly if the young person sought the care confidentially. Legal advice is recommended for complex situations.
Does the Privacy Act apply to school reports and student records?
Yes. Student records are personal information and subject to the Privacy Act. Schools must provide access to records when requested by parents or students. Records should be kept securely and only disclosed to authorised persons.
How long should schools keep records about students?
The Public Records Act and MoE guidelines apply to school records. Student records should be retained for at least 7 years after the student leaves, or until the student turns 25 — whichever is later. Check MoE's specific guidance for different record types.