Under the Privacy Act 2020, a New Zealand training provider stays accountable for learner data even when an AI vendor processes it. There's no AI-specific law to hide behind. Before signing, ask every vendor who owns the data, whether it trains models on it, where it's stored, and how you get it back.
Who is responsible for learner data when an AI tool processes it?
You are. New Zealand has no AI-specific legislation. According to the regulations.ai overview (a third-party aggregator, so check it against Office of the Privacy Commissioner sources), the technology-neutral Privacy Act 2020 and its 13 Information Privacy Principles (IPPs) apply across the AI lifecycle. That includes prompt processing and the generation of outputs.
For a Private Training Establishment (PTE), that means a vendor's terms don't move your obligations. They only decide how easy it is to meet them.
What has changed recently?
Three things make this a live question rather than a theoretical one.
IPP 3A is now in force
IPP 3A came into force on 1 May 2026 under the Privacy Amendment Act 2025. It requires notification when personal information is collected other than from the individual (Office of the Privacy Commissioner, Ministry of Justice). It matters when you pass learner data to an AI vendor. It also matters when a vendor generates or enriches data about your learners.
NZQA is reshaping quality assurance
NZQA's integrated Quality Assurance Framework consultation closed on 7 September 2026. It proposes Highly Effective, Effective and Not Effective descriptors, as reported by Indian Newslink, a secondary source. Check NZQA's own consultation page for the detail.
Assessment practice and quality management systems would be among the weighted criteria. So where AI-generated assessment evidence and learner records sit, and who can access them, becomes an audit question.
Learner records are moving between entities
Work-based learning divisions transferred from NZIST (formerly Te Pūkenga) to an Industry Skills Board in January 2026. The transition runs through 2026 and 2027, and NZIST is to be disestablished on or before 31 March 2027 (TEC, Ministry of Education).
When programmes change hands, a contract that's silent on data control becomes a problem fast.
Can a vendor reuse learner data to improve its models?
Only if the original purpose allows it. IPP 10 limits use of personal information to the purpose it was collected for. Newsroom's 4 June 2026 guide says this raises questions where existing datasets are reused for new AI-driven processes. It also notes that agencies stay responsible for decisions made using AI tools.
So "we use your data to improve our service" is not a throwaway line. It's a purpose question, and you need it answered in writing.
What should you ask an AI vendor before signing?
The Office of the Privacy Commissioner's September 2023 AI guidance remains the benchmark. It recommends a privacy impact assessment before adopting AI tools, and transparency about how, when and why they're used. A secondary summary says it also expects proper terms with vendors.
Put these questions to every vendor:
- Role. Are you a processor acting on our instructions, or do you use learner data for your own purposes?
- Model training. Is our learner data, or anything derived from it, used to train or improve models?
- Location. Where is data stored and processed? How do you handle cross-border disclosure under IPP 12?
- Exit. Can we export everything in a usable format? What's deleted, when, and how do we verify it?
- Credentials and public links. If the tool issues credentials or certificates, who issues them, and are they reachable at public links?
- Restructure. Who controls the data if we merge, hand over programmes or change entity?
- Māori data sovereignty. How does the tool respect it, and can we explain that to learners?
That last question isn't decoration. NZQA's guidance on academic integrity and AI expects providers to explain Māori data sovereignty to learners and to help staff understand how generative AI can be used.
What does a concrete answer look like?
Vendor documentation tends to contain specifics once you read it closely. Our own Nova 5 service description is an example. It says analytics may include coarse city-level location, with no raw IP address stored against learner activity. It also says learners on AI Fluency-only learning spaces can claim a non-accredited micro-credential issued by Supahuman Limited, not the provider, verifiable at a permanent public link.
Those are vendor claims, not independently verified, and they're the kind of detail to test. Is a permanent public credential link acceptable for your learners? Does city-level analytics fit your IPP 3A notices? Our research found no published privacy policy, data processing terms or data-residency statement alongside them. Ask for those directly, including how cross-border disclosure is handled given the vendor's Sydney hub. Ask us as readily as anyone else.
How do you turn the answers into a decision?
Complete a privacy impact assessment before adoption, not after. Record the vendor's answers, update your learner privacy notices, and make sure your quality management system shows where AI-generated assessment material and learner evidence live.
If an answer is vague, treat it as a no until it's written down.
Key takeaways
- No AI-specific law exists in New Zealand. The Privacy Act 2020 applies, and your accountability stays with you.
- IPP 3A (in force 1 May 2026) adds notification duties when learner data is collected indirectly or enriched by a vendor.
- IPP 10 makes model-training reuse a purpose question, not a default right.
- NZQA's quality framework and the vocational reforms make data location, access and handover audit and contract issues.
- Run a privacy impact assessment and get vendor answers in writing before you sign.
Our take
Most providers ask AI vendors about features and price, then discover the data questions at renewal or audit. That order should flip. With IPP 3A live and NZQA weighing assessment practice and quality systems, a vendor who can't state clearly where learner data sits and how you leave is a risk to your next external evaluation, however good the demo looks. Good vendors will welcome the scrutiny.
FAQ
Does New Zealand have a specific AI law that covers learner data?
No. The Privacy Act 2020 and its 13 Information Privacy Principles apply to AI use, according to the regulations.ai overview. Verify the detail against the Office of the Privacy Commissioner's guidance. Providers remain accountable whichever vendor processes the data.
What is IPP 3A and why does it matter for training providers?
IPP 3A came into force on 1 May 2026. It requires notification when personal information is collected other than from the individual. It's relevant when you share learner data with an AI vendor, or when a vendor generates or enriches data about learners.
Do we need a privacy impact assessment before adopting an AI tool?
The Office of the Privacy Commissioner's September 2023 AI guidance recommends one before adopting AI tools, along with transparency about how, when and why they're used. It's good practice for any tool touching learner records.
What should a contract say about restructures and the vocational reforms?
It should state who controls the learner data if you restructure or hand over programmes. Work-based learning divisions moved from NZIST to an Industry Skills Board in January 2026, and NZIST is to be disestablished on or before 31 March 2027 (TEC).
Where can I verify these requirements?
Check the Office of the Privacy Commissioner, the Ministry of Justice, NZQA and TEC directly. Some sources used here are secondary summaries, so treat them as pointers rather than authority.