Digital identity in New Zealand: what should your business check before using a provider?

Before using a digital identity provider in New Zealand, check the provider and service, what information will be shared, the authorisation process and the contract. Trust Framework accreditation applies to specified services and does not remove your own privacy obligations. Assess the actual customer journey before introducing the system.

What is a digital identity service?

A digital identity service helps establish or use information about a person or organisation online. That might involve verifying an attribute, linking information to the right person or authenticating someone returning to a service. Those functions carry different risks, so begin with what the proposed product actually does.

For example, a business may need evidence of a customer’s eligibility for a particular service rather than a complete identity-document file. Ask what result the business needs and whether the supplier’s process collects more information than that task requires.

What is the current New Zealand legal framework?

The Digital Identity Services Trust Framework Act 2023, regulations and rules establish an accreditation framework. It is an operating regime, rather than the proposal described in older newsletter coverage. Accreditation participation is voluntary; a business should not assume every digital identity service is accredited.

The current consolidated rules took effect on 29 June 2026. Official accreditation guidance says applications from 28 September 2026 must comply with that consolidated version. A supplier assessment should therefore use current requirements and evidence, rather than relying on a statement based on the original 2024 rules.

What does a provider’s accreditation cover?

Check the particular accredited service, not just the company name or a marketing badge. The Trust Framework Authority assesses providers and the services for which accreditation is sought, including identification management, privacy and security requirements. Accreditation does not turn every product sold by that supplier into an accredited service.

Ask the provider to identify its accreditation, scope and any relevant limitations. Keep that evidence with the procurement records. If the proposed workflow combines several suppliers, establish which party performs each step and which service is being relied on.

What should customers understand before information is shared?

Customers should receive clear information about the proposed transaction and authorisation. The Trust Framework rules address informed authorisations and privacy safeguards. Do not replace an understandable explanation with a general statement that the system is secure.

Walk through the screens as a customer would. Can someone see what is requested, who will receive it and why? What happens if information is incorrect or the verification fails? An accessible alternative and a route to human assistance are practical design questions to resolve before launch.

Does using an accredited provider satisfy the Privacy Act?

No. Your organisation still needs to assess its own collection, handling and disclosure. Consider what you need, what people are told, who can access the result and how long information is kept. From 1 May 2026, information privacy principle 3A adds notification obligations for indirect collection, subject to its exceptions.

If the system obtains information from another organisation, check those requirements against the actual data flow. If biometrics are involved, assess the separate biometric privacy requirements as well. A contractual promise of compliance does not answer every question about how your organisation uses the information.

What should the supplier agreement and implementation plan cover?

They should connect the technical service with clear operational responsibilities. Work through the process with the people handling customer enquiries, privacy requests and supplier incidents.

• Describe the identity checks and the result your business receives.
• Identify data storage, access, subcontractors and relevant overseas handling.
• Set responsibilities for errors, support, incidents and record retention.
• Review contract changes, service continuity and exit arrangements.
• Document the customer explanation and internal escalation process.

Canterbury Legal provides commercial-contract advice and business legal services to help assess the agreement and responsibilities. Contact our Christchurch team with the proposed workflow, supplier terms and accreditation information before committing.

What other questions do people ask?

Is every digital identity provider accredited?

No. The framework is voluntary. Check the provider and the specific service rather than assuming accreditation from a general product description.

Does accreditation cover every service a supplier offers?

No. Accreditation relates to the services assessed and accredited under the framework. Confirm the scope relevant to the workflow you propose to use.

Can we rely on the supplier to handle every privacy obligation?

No. Your organisation must assess its own responsibilities and use of information. The supplier agreement should allocate tasks clearly without assuming it removes statutory obligations.

Which official sources explain these rules?

• Official Trust Framework legislation and current rules
• Official provider and service accreditation guidance
• Trust Framework Rules: authorisation, privacy and security
• Privacy Commissioner: indirect-collection notification, IPP3A
• Government regulatory impact statement: voluntary framework

Information checked on 28 October 2026. This article provides general information about New Zealand law and is not a substitute for advice about your circumstances.