Privacy Act 2020

New Zealand’s privacy law, built on thirteen information privacy principles. Two matter most when an AI system is involved: the limits on what you may do with information collected for another purpose, and the restrictions on sending personal information overseas.

Published by Office of the Privacy Commissioner.

Start a conversation

What it asks for

Collect only what you need, for a purpose you have stated.
Do not use or disclose information for a different purpose without a lawful basis.
Under IPP12, personal information may only go offshore where comparable safeguards apply.
Notifiable privacy breaches must be reported where serious harm is likely.

What we do about it

IPP12 is the reason we default to on-shore inference or your own tenancy rather than whatever endpoint is cheapest.
We map what data a system touches before it is built, not after a breach.
Purpose limitation is enforced in the system, not just written in a policy.

Read it at the source: Office of the Privacy Commissioner. We describe it here, we do not speak for it.

The other frameworks we build to

This is a plain description of what these frameworks ask for and how we build to them. It is not legal advice, and it is not a claim of endorsement, accreditation or partnership. Where a framework governs your organisation, take your own advice on it.

Building something this framework touches?

Start a conversation

Inference that answers to tikanga, not just to a benchmark.

We build and run inference against the six principles of Māori data sovereignty set out by Te Mana Raraunga. For an organisation holding data about its own people, that is not a line at the bottom of a page. It decides where the model runs, what it is allowed to see, and who can switch it off. Māori data stays Māori owned. Running a model over it does not transfer it, licence it, or turn it into training data.

Rangatiratanga

Authority. You decide what the model may see and what it may do with it. Access is yours to grant and yours to withdraw, and a withdrawal takes effect at the next inference, not at the next contract review.

Whakapapa

Relationships. Every output can be traced back to the documents, the records and the rules that produced it. Nothing arrives without a provenance you can follow.

Whanaungatanga

Obligations. Data gathered for one purpose is not quietly turned to another. A new use is a new conversation with you, not a schema change on our side.

Kotahitanga

Collective benefit. The gain comes back to the people the data came from, as hours returned to their staff and services that work better for their whānau.

Manaakitanga

Reciprocity. We leave you able to run it without us. Documentation, handover and the right to take the system elsewhere are part of the build, never an exit fee.

Kaitiakitanga

Guardianship. We hold your data in trust and never take ownership of it. It does not train our models or anyone else’s, it is returned or destroyed on request, and inference runs somewhere you can point at, on-shore or inside your own tenancy.

The six principles are those of Te Mana Raraunga, the Māori Data Sovereignty Network. The commitments beside them are ours.

Built on three things we don’t bend on.

Honesty

We tell you what AI can and cannot do, then we ship the part that pays for itself.

Speed

Find the one workflow costing the most, ship it to production, prove the return.

Care

Success is hours given back to people and dollars saved. Never the size of the invoice.