AI customer service and the NZ Privacy Act 2020
Personal information collected by AI assistants is still personal information. A plain-language checklist for designing compliant conversational AI.
14 September 2026 · 5 min read
The same principles apply
The Privacy Act 2020 and its Information Privacy Principles apply whether information is collected by a person, a web form or an AI assistant. Organisations should collect only what they need, be clear about why, keep it secure and use it for the purpose it was collected.
Design choices that help
Tell callers and chat users they are speaking with an AI assistant. Limit what the assistant asks for to what the journey actually requires. Keep access to connected systems role-based, log actions, and set retention periods for transcripts and recordings.
Offshore processing
Many AI services process data in other countries. Information Privacy Principle 12 covers disclosure of personal information overseas, so organisations should understand where data is processed and the protections in place. AIIT discusses hosting and data-handling options during design.
Human oversight
Keep people responsible for decisions with significant effects on individuals, and make it easy for customers to reach a person. This note is general information, not legal advice; organisations should seek their own advice for specific obligations.
Talk to AIIT about your first AI journey.
What jobs can a SAM do?
Browse 81 Typical SAM Roles — from receptionist and claims specialist to compliance, sales and operations — each a Digital Employee powered by ANNA and managed by AIM.
Start a conversation about privacy act ai customer service.
Tell us what you want to improve. Your enquiry will go directly to the AIIT team in Auckland.