The Customer and Product Data Bill (Bill) was granted Royal assent on 29 March 2025, the final stage in the legislative process. The Bill is now the "Customer and Product Data Act" (Act).
The Act establishes a Consumer Data Right (CDR) in New Zealand. For further background on the CDR, including the process leading up to the release of the Act, please see our related Insights here.
Minor amendments now included
The Act incorporates several minor amendments made following the second reading, as set out in Amendment Paper 254. These changes include:
- extending the definition of "customer" to include a person who has acquired goods or services from a data holder in the past;
- amending the definitions of "designated customer data" and "designated product data" to apply to any customer or product data as specified by the relevant regulations (regardless of whether that data was held prior to the regulations);
- extending the circumstances under which an authorisation may end to expressly refer to the relevant customer ending an authorisation;
- clarifying record keeping requirements for data holders and accredited requestors once an authorisation has ended;
- enabling the regulations to provide for a person to opt in to being in-scope of the regime (in addition to those persons or classes of persons otherwise designated); and
- confirming that data about customers may be designated by the regulations even if it may include personal information of a third party (and, for this change, the example of customer transaction data is provided).
For more detail on the Committee's discussions of the Bill, please see the Hansard records here.
Next steps
Regulations will be implemented containing more detail to support the framework created by the Act.
At the third reading, the Minister of Commerce and Consumer Affairs, Hon Scott Simpson, re-confirmed that the banking sector will be the first sector designated by the CDR and indicated that the banking regulations can be expected to be in place "well before Christmas" and to take effect "by Christmas".
The Minister also re-asserted the intention that electricity will be the next sector regulated by the Act. We expect to hear in the first half of this year whether the electricity sector will be designated in scope of the CDR. If so, the Government has previously signalled (in the discussion paper on CDR for the electricity sector from August 2024) that the associated regulations for the electricity sector would take effect sometime in 2026.
Businesses in the banking and electricity sectors should use the time available to understand how the CDR is likely to impact them and, to the extent possible ahead of their respective regulations being available, consider how to align their current policies and practices to be compliant.
What this means for businesses
Russell McVeagh will continue to monitor for developments and provide further updates in the CDR space. You can join our mailing list to receive updates as they are released. If you would like any advice regarding how the CDR might affect you and organisations in your industry, please do not hesitate to contact us.