---
title: "New Zealand Privacy Act 2020 — KYE Protocol™ coverage"
description: "New Zealand Privacy Act 2020 coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it."
url: https://kyeprotocol.com/compliance/nz-privacy-act-2020/
lang: en
source: "KYE Protocol"
---

> New Zealand Privacy Act 2020 coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it.

New Zealand Privacy Act 2020

# New Zealand Privacy Act 2020 — 88% of in-scope requirements covered.

4 requirements · 4 in scope (3 enforced · 1 designed). The 88% is weighted over the in-scope base.

**Source:** Privacy Act 2020 (New Zealand) — Information Privacy Principles (IPPs) + Part 6 notifiable privacy breaches.

## By category

| Category | Reqs | Enforced | Designed | Advisory | Deferred | Coverage |
| --- | --- | --- | --- | --- | --- | --- |
| Storage and security (IPP 5) | 1 | 1 | 0 | 0 | 0 | **100%** |
| Limits on use (IPP 10) | 1 | 1 | 0 | 0 | 0 | **100%** |
| Access to personal information (IPP 6) | 1 | 1 | 0 | 0 | 0 | **100%** |
| Notifiable privacy breaches (Part 6) | 1 | 0 | 1 | 0 | 0 | **50%** |

## Every requirement → the KYE™ artefact that enforces it

| ID | Title | Status | KYE™ enforcement |
| --- | --- | --- | --- |
| `nz-privacy-act-2020.ipp-5` | Information Privacy Principle 5 — an agency must ensure personal information is protected by reasonable security safeguards against loss, unauthorised access, use, modification or disclosure | enforced | **audit\_events**: `kye.purpose.admissibility.v1`, `kye.evidence.tool_call.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `nz-privacy-act-2020.ipp-10` | Information Privacy Principle 10 — personal information obtained for one purpose must not be used for another purpose without authority | enforced | **audit\_events**: `kye.purpose.request.v1`, `kye.purpose.admissibility.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `nz-privacy-act-2020.ipp-6` | Information Privacy Principle 6 — an individual is entitled to access personal information held about them, supported by a record of how that information was used | enforced | **audit\_events**: `kye.evidence.pack.v1`, `kye.replay.proof.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `nz-privacy-act-2020.notifiable-breach` | Part 6 — notifiable privacy breach: notify the Privacy Commissioner and affected individuals of a privacy breach that has caused or is likely to cause serious harm | designed | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.compliance.attestation.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |

Canonical KYE™ surfaces referenced on this page: [KYE Protocol™](https://kyeprotocol.com/).