The Privacy Act 2020: a guide for psychologists in New Zealand
Client records held by a psychologist are about as sensitive as personal information gets, and how you collect, store, share and eventually dispose of them is governed by New Zealand's Privacy Act 2020. Here's what it actually requires, in practical terms, for a psychology practice.
What the Privacy Act 2020 is
The Privacy Act 2020 is New Zealand's core privacy legislation, replacing the earlier 1993 Act. It sets out 13 Information Privacy Principles governing how agencies — including a sole-practitioner psychology practice or a clinic — collect, use, store, disclose and dispose of personal information. The Office of the Privacy Commissioner is the independent regulator responsible for the Act, including receiving complaints and issuing guidance.
Lawful basis and consent
You need a proper basis for collecting and using client information, and for talk therapy that's generally straightforward: you collect what's necessary to provide the service, with the client's knowledge, typically as part of an intake process. Where information will be shared beyond direct care — with a referrer, an ACC claim, or a colleague for supervision — the client should generally know this is happening and, in many cases, have given consent, rather than finding out after the fact.
Data security
The Act requires you to take reasonable steps to protect personal information from loss, unauthorised access, use or disclosure. In practice, that means client records — whether digital or paper — should be reasonably secured: encrypted where digital, backed up, access-limited to people who actually need it, and not left in a position where a lost laptop or an unlocked cabinet becomes a serious problem.
A breach involving serious harm must be notified. The Privacy Act 2020 requires you to notify the Office of the Privacy Commissioner (and generally the affected individuals) of a privacy breach that has caused, or is likely to cause, serious harm. If something goes wrong — a misdirected email with client information, a lost device — check the current notification requirements and timeframes directly with the Office of the Privacy Commissioner rather than guessing at what's required.
Your clients' rights
Clients generally have the right to access the personal information you hold about them, and to request correction if it's inaccurate. For clinical records, this includes session notes — which is one more reason to write notes as though the client might one day read them, since under the Act, they're entitled to ask. See our guide to what to include in session notes for how that shapes what you write.
Retention and disposal
Personal information shouldn't be kept longer than it's needed for the purpose it was collected — but clinical records also come with their own retention expectations tied to good practice and potential future need, so "delete everything as soon as possible" isn't the right instinct either. Decide on a retention approach deliberately, rather than by default, and be able to explain it if asked.
Practical steps worth taking
- Use practice-management software that encrypts client data and lets you export or delete a client's record on request.
- Be clear with clients, early on, about what information you collect and who it might be shared with (an insurer, ACC, a supervisor) and why.
- Know, in advance, what you'd do if a breach happened — who you'd notify and how quickly — rather than figuring it out under pressure.
- Limit access to client records to people who genuinely need it, even within a small practice.
Frequently asked questions
What is the Privacy Act 2020?+
The Privacy Act 2020 is New Zealand's core privacy legislation, setting out 13 Information Privacy Principles that govern how organisations, including psychology practices, collect, use, store, share and dispose of personal information.
Who regulates privacy compliance in New Zealand?+
The Office of the Privacy Commissioner is the independent regulator responsible for the Privacy Act 2020, including receiving complaints and providing guidance on compliance.
Do I have to report a data breach?+
Yes, in certain circumstances. The Privacy Act 2020 requires notification to the Office of the Privacy Commissioner (and often to affected individuals) of a privacy breach that has caused, or is likely to cause, serious harm. Check the current notification requirements and timeframes directly with the Office of the Privacy Commissioner if you experience a breach.
Client records handled with the privacy they deserve
Encrypted, backed up, and exportable or deletable on request — built for psychologists.
14 days free, no card · No lock-in · We answer directly
Nerela is practice management software built for psychologists and clinics: scheduling and online booking, patient records and session notes, invoicing and reports — in one place, with data hosted in the European Union. You start with 14 days free, no card, and you talk directly to the people building the product.
Start on Nerela — 14 days free →