Two statutes decide most of what a New Zealand business can and cannot do with email and text marketing. The Unsolicited Electronic Messages Act 2007 answers the question “am I allowed to send this message?”. The Privacy Act 2020 answers “am I handling this person’s information properly?”. A campaign has to satisfy both. This page summarises each one as it applies to marketers, then looks at what changes when you mail people overseas.
This is general information, not legal advice. For decisions about your own business, talk to a New Zealand lawyer.
The Unsolicited Electronic Messages Act 2007
The Act, usually shortened to the UEMA, came into force on 5 September 2007 and is enforced by the Department of Internal Affairs (DIA). It applies to commercial electronic messages sent to, from or within New Zealand, which covers email, text (TXT) messages, instant messaging, fax and image-based messages. Voice calls and website pop-ups are outside it. Because the test is where messages go, not where the sender sits, an overseas business mailing New Zealanders is covered too.
Every commercial message must meet three requirements:
- Consent. The recipient must have consented to receive it (see the three types below).
- Sender identification. The message must include accurate information about the person or organisation that authorised it, and how to contact them.
- A functional unsubscribe facility. It must be clear and conspicuous, free to use, work through the same channel the message came by (a reply by text for an SMS, for example), and keep working for at least 30 days after sending. Once someone uses it, their consent is treated as withdrawn from 5 working days later.
The Act also prohibits using address-harvesting software, or lists created with it, to send unsolicited commercial messages. That is one of several reasons to never buy an email list.
Express, inferred and deemed consent
Express consent is a clear yes: a ticked box, a form submission, or a verbal agreement that you have recorded. Inferred consent can arise from a business or other relationship, as long as the message relates to it; DIA’s guidance is that a single purchase is not enough to infer consent to ongoing marketing. Deemed consent applies when someone has conspicuously published their work address (on a company website, for example), the message relates to their role, and they have not said they do not want unsolicited messages. Our guide to getting permission to send email campaigns goes through each type with examples.
Messages that are not “commercial”
A message that facilitates, completes or confirms a transaction the recipient has already agreed to, such as an order confirmation, invoice or delivery notice, is not treated as a commercial electronic message. Add a promotion to it and that protection can disappear.
Enforcement and penalties
DIA can issue formal warnings, accept enforceable undertakings, seek injunctions and apply to the District Court for civil pecuniary penalties of up to $200,000 for an individual and up to $500,000 for an organisation. People affected by spam can also seek compensation or damages. Complaints are made to DIA.
The Privacy Act 2020
The Privacy Act, overseen by the Privacy Commissioner, governs any personal information you hold, including a subscriber list. Its Information Privacy Principles (IPPs) translate into everyday marketing practice:
- Collect for a clear purpose and only what you need (IPP 1), and tell people why at the point of collection (IPP 3). A short privacy statement next to your subscription form does the job.
- Tell people when you get their details from someone else. IPP 3A, added by the Privacy Amendment Act 2025, has applied since 1 May 2026 to personal information collected indirectly, for example from an event partner or a referral scheme.
- Keep it secure (IPP 5), let people access and correct it (IPPs 6 and 7), and do not keep it longer than necessary (IPP 9).
- Report serious breaches. A privacy breach that has caused, or is likely to cause, serious harm must be notified to the Privacy Commissioner and affected people as soon as practicable. Failing to notify is an offence with a fine of up to $10,000.
- Take care with overseas disclosure (IPP 12). Where a provider only stores or processes data on your behalf, the Privacy Commissioner’s guidance is that you generally remain responsible for it, rather than it being a disclosure overseas.
Mailing people outside New Zealand
Exporters and tourism businesses often have subscribers abroad, and local law follows those people. Recipients in the European Union are protected by the GDPR, and those in the UK by the UK GDPR, both of which set a high bar for consent and transparency. If much of your list lives overseas, get advice for those markets too. New Zealand itself holds an EU adequacy decision, which makes it easier for European organisations to send personal data here.
Text messages follow the same rules
The UEMA treats a marketing text exactly like a marketing email: consent, sender identification and an unsubscribe that works by reply. Our SMS marketing page covers the practical details for New Zealand mobile numbers.
How Mailpro helps
Mailpro stores your contacts in Switzerland on private infrastructure, outside US jurisdiction. Switzerland, like New Zealand, has an EU adequacy decision, and Mailpro never sells or rents your data. Double opt-in forms help you prove express consent, and unsubscribe links in your campaigns give recipients a free way to opt out. Read more about why Mailpro hosts in Switzerland, or get a quick overview in our Q&A: is email marketing legal in New Zealand?