How to use Companies Office data compliantly through DEIS

The Companies Office, part of MBIE, maintains the New Zealand Companies Register — the authoritative source of company information, including director details, shareholdings, and registered addresses.

What triggers IPP3A?

When you search for a company and the results include personal information about directors, shareholders, or other individuals, you are collecting personal information from a third-party source. The fact that the Companies Register is publicly accessible does not automatically remove your IPP3A obligations.

The "publicly available" exception

IPP3A includes an exception where the information is publicly available. Company director names and addresses on the register are publicly available. However, the OPC has indicated that the exception should be interpreted narrowly — just because information is technically accessible does not mean an agency has no obligation to be transparent about collecting it.

Best practice

Even when the publicly available exception may apply, best practice is to:

• Record that the exception was relied upon for each specific lookup.

• Document your reasoning for relying on the exception.

• Be prepared to justify the decision if the OPC investigates.

DEIS integration

DEIS connects to the Companies Office register and allows users to select the appropriate IPP3A pathway for each search — including the publicly available exception, with a recorded justification. This creates the evidence trail the OPC expects.