On 29 March 2025, the Customer and Product Data Act 2025 (Act) was passed, officially becoming law in New Zealand and coming into force on 30 March 2025.

The Act establishes an economy-wide ‘consumer data right’ framework to enable greater access to, and sharing of, customer and product data between businesses. Over time, designated sectors will become subject to the Act under regulations and standards containing more detailed rules about how the framework will apply to that sector.

The framework enables customers (including both individuals and entities) to make requests to designated organisations (data holders) under the Act for:

• the transfer of their data to ‘accredited requestors’;
• information and data relating to a product (for example, generic information about the organisation’s goods and services, not related to a specific customer), and
• certain actions to be undertaken in relation to a customer’s account (action-initiation).

The intention of a consumer data right is to:

• give customers better control over and access to their data;
• promote innovation and facilitate competition; and
• facilitate secure, standardised and efficient data sharing services.

The first designated sector – banking 

Banking is the first sector to which the framework will apply, facilitating a concept commonly referred to as ‘open banking’. Up until now, development of open banking in New Zealand has been led by the industry-owned Payments NZ Limited through the API Centre and the development of Application Programming Interface (API) standards. Last year, in its final report into competition in the personal banking sector, the Commerce Commission pointed to the acceleration of open banking as a game-changer for revolutionising consumer choice in the banking sector, encouraging the government to speed up a mandated regime.

In August 2024, MBIE released an initial consultation on what the regulations to implement open banking under the Act might look like – including the scope, accreditation criteria for accredited requestors, and more detailed operational rules.

MBIE has proposed that the Act only applies to the four largest banks as data holders to begin with, being ANZ, BNZ, Westpac and ASB. Kiwibank would be required to follow suit 6 months later, and then other banks and deposit takers would be invited to opt-in.

The type of customer data proposed to be covered includes contact and identifying information, eligibility for services and offers by the data holder, and transactional information relating to savings, transactions, credit card and lending accounts (for example, statements, balances, payment obligations and authorities). 

MBIE is still considering whether to designate product data in open banking. If covered, product data could include fees, interest rates, features, benefits, terms and conditions, and eligibility criteria, provided none of it is specific to a customer. The banking industry has urged MBIE to take caution when considering whether to designate product data, pointing out the risks of inadvertently requiring disclosure of commercially sensitive information or bank derived data (which could constitute bank intellectual property).

Data holders can refuse to provide product data if they reasonably believe that disclosure would likely have a materially adverse effect on the security, integrity or stability of their ICT systems or the register of data holders and accredited requestors, as established by the Act. There is also provision for regulations to carve out other exceptions to the requirement to disclose product data, and it remains to be seen if MBIE will do this in response to the banks’ concerns, such as limiting product data to publicly available information from banks’ advertising and websites.

The role, requirements and responsibilities of accredited requestors

MBIE is the agency responsible for reviewing and approving applications for accreditation by accredited requestors. The Act contains provision for certain criteria to be considered where designated under regulations when MBIE is assessing these applications.

For the banking sector, MBIE is proposing that accreditation criteria includes:

• that the applicant’s directors and senior managers are fit and proper persons for their positions;
• insurance requirements;
• information security requirements; and
• demonstration of how the applicant will comply with its policies relating to customer data, product data, and action initiation, as well as the Act generally.

The Act also requires accredited requestors to comply with relevant regulations and standards when acting on behalf of customers to make requests. For banking, MBIE proposes that accredited requestors must give the customer the following information when seeking their authorisation to request customer data from their bank: 

• the specific data or action that will be requested;
• the goods and services that the data will be used to provide to the customer;
• any intended use of the data that is not necessary to provide the service (customers would have to opt-in to this rather than it being “bundled in”); and
• a link to the accredited requestor’s customer data policies.

These requirements would help ensure that customers are giving informed consent when authorising accrediting requestors to request banking data on their behalf.

Interaction with Privacy Act 2020

The Act makes it clear a data holder’s obligation to respond to IPP 6 requests under the Privacy Act is not affected by a customer data request under the Act. In theory, a customer could make the same request for their personal information under the Act and IPP 6 at the same time and a data holder would have to respond to each request in line with the separate requirements and obligations.

Helpfully, the Act is explicit as to what breaches will give rise to liability under the Privacy Act.  If a data holder breaches their obligations to respond to a customer data request under the Act, this could be held as interference with a person’s privacy for the purposes of the Privacy Act, for which that person can seek the related remedies.

In addition, if a data holder breaches a data storage and security requirement in relation to customer or product data under the Act, this constitutes a breach of IPP 5 under the Privacy Act.

The Act also includes a ‘good faith defence’ which makes it clear that data holders should not be liable under the Privacy Act, contract or other non-statutory obligations for disclosing customer data to a fraudulent requestor under the Act provided that they complied in good faith with the Act’s requirements.

Penalties

The Act includes significant fines in the case of certain areas of non-compliance, including a potential fine of up to NZ$2.5m for body corporates which fail to operate an electronic system when required to do so. This level of fine dwarfs the maximum fine available under the Privacy Act, and is significantly higher than the maximum fines available under other consumer protection laws such as the Fair Trading Act 1986. The potential maximum fines are more aligned with those available to regulators under the Commerce Act 1986 – reflecting perhaps the fact that the Act is one designed primarily to open up competition in a sector, rather than one that purely focuses on access to data.

Body corporates can also be subject to a fine of up to $600k for failing to respond to a request under the Act, not obtaining appropriate authorisations from customers and for an electronic system not complying with prescribed technical or performance requirements.

What’s next?

The next steps are for MBIE to develop regulations and standards under the Act to implement open banking, taking into account feedback received on its initial proposals. The current timeline is for these to be finalised in late 2025 and come into effect in 2026.

Electricity is pipped as the second sector to be designated under the Act, with MBIE also having started exploring how a consumer data right could look in this industry. In time, it’s likely telecommunications and insurance will follow.

How we can help

Our consumer, data and privacy experts Campbell Featherstone and Hayley Miller are on hand to answer questions about the Act. We can provide practical advice on preparing for compliance with the Act and the Privacy Act generally. This could include advising on your contractual arrangements with ICT and other suppliers, to ensure that you can meet the requirements of the Act. You can also reach out to our open banking experts Liz Lim and Wook Jin Lee.

This article was written by Natalie Fraser-Jones, an Associate in Dentons’ Corporate and Commercial team.