# How does the Privacy Act 2020 apply to loyalty programmes?

The Privacy Act 2020 governs how a New Zealand business collects, uses, stores and discloses personal information, which includes everything a loyalty programme holds about a customer. The practical rules are: collect only what you need, say what it is for, keep it secure, and let people see and correct it.

Source: https://fidella.app/glossary/privacy-act-2020
Last reviewed: 2026-08-30

---

Running a loyalty programme means holding personal information, and that brings
obligations regardless of how small the business is.

## The practical shape

Collect only what you actually need. Be clear at the point of collection about
what it is for. Keep it secure. Let people access and correct what you hold
about them. Do not keep it longer than you need it.

## The most common failure

Collecting a date of birth, a phone number and an address because the form
allowed it, with no use for any of them. Every extra field is something to
protect and something to explain.

## Using a platform does not transfer the duty

Your provider handles a great deal of this on your behalf, but the relationship
with your customer, and the obligation, remain yours.