Yes. Email marketing is legal in New Zealand, and widely used by businesses of every size. What the law regulates is how you do it. The Unsolicited Electronic Messages Act 2007 (UEMA), enforced by the Department of Internal Affairs (DIA), sets the rules for commercial email and text messages, and the Privacy Act 2020 governs the personal information behind them. Below are short answers to the questions we hear most often. For the full picture, see our guide to email marketing law in New Zealand.
This is general information, not legal advice.
Do I need permission before I send a marketing email?
Yes. A commercial electronic message needs the recipient’s consent. That can be express (they signed up or clearly agreed), inferred from an existing relationship the message relates to, or deemed, in limited business situations. Express consent is the easiest to prove and the least likely to be challenged.
Can I email other businesses without asking first?
Sometimes. If a person has conspicuously published their work email address, for example on their company’s website, and your message is relevant to their role, consent may be deemed. It is not deemed if the publication says they do not want unsolicited messages. A generic sales blast to every address you can find is unlikely to qualify.
Can I email people who bought from me once?
Be careful. DIA’s guidance is that you cannot reasonably infer consent to ongoing marketing from a single purchase. The simple fix is to offer a clear opt-in at checkout or on the receipt page.
Are order confirmations and invoices covered?
A message that facilitates, completes or confirms a transaction the recipient already agreed to is not a commercial electronic message. Keep those emails factual. Once you add promotions, the consent and unsubscribe rules apply.
Can I buy or rent an email list?
You would not have the consent of the people on it, and the UEMA also prohibits using address-harvesting software or harvested lists for unsolicited commercial messages. Buying lists also hurts deliverability. Build your own with a subscription form instead.
What must every marketing email include?
- Accurate details of who authorised the message and how to contact them.
- A clear, free unsubscribe facility that works for at least 30 days after sending.
- Honest content. The Fair Trading Act 1986 also applies to marketing claims, whichever channel you use.
How fast must I act on an unsubscribe?
Consent is treated as withdrawn from 5 working days after the person uses your unsubscribe facility. Remove them from every marketing list and journey, not only the newsletter they clicked from. A clean List-Unsubscribe header also helps mailbox providers handle opt-outs smoothly.
Does the law apply if my business is overseas?
Yes. The UEMA covers messages sent to, from or within New Zealand, so an Australian or European company emailing New Zealanders is covered, and so is a New Zealand company emailing people abroad. Those overseas recipients may also be protected by their own laws, such as the GDPR in the European Union.
Does it cover text messages?
Yes. Marketing texts need consent, must identify the sender and must offer an unsubscribe that works by text. See SMS marketing in New Zealand.
What happens if I break the rules?
DIA can issue formal warnings, accept enforceable undertakings and seek injunctions. For serious cases, the District Court can order civil pecuniary penalties of up to $200,000 for an individual and up to $500,000 for an organisation. Affected people can also seek compensation or damages.
Do I also need a privacy statement?
Under the Privacy Act 2020, you should tell people what you collect, why, and how they can access or correct it (IPPs 3, 6 and 7). Since 1 May 2026, IPP 3A extends this to information you get indirectly, such as contacts passed on by a partner. You also stay responsible for data a provider stores on your behalf. Mailpro keeps it in Switzerland on private infrastructure, outside US jurisdiction; see why Switzerland.
What is the simplest safe approach?
Collect express consent with a clear form, use double opt-in so you have proof, identify yourself in every message, and make unsubscribing easy. Our page on permission to send email campaigns shows how.