Customer Data and Privacy Basics for New Zealand Automotive Workshops
A practical introduction to handling customer names, phone numbers, vehicle information and workshop records under New Zealand privacy principles.
Automotive workshops routinely hold personal information such as names, phone numbers, email addresses, booking details and job records. New Zealand's Privacy Act 2020 sets principles for how organisations collect, store, use and disclose personal information.
Collect only information you need
The Office of the Privacy Commissioner explains that personal information should only be collected for a lawful purpose connected with the organisation's activities and when the information is necessary for that purpose.
Tell customers why information is being collected
When collecting personal information, make the purpose clear. For example, contact details may be needed to manage bookings, repair approvals, invoices or requested reminders.
Protect stored information
Privacy Principle 5 requires reasonable safeguards against loss, unauthorised access, use, modification, disclosure or other misuse. Staff access should match what they actually need for their role.
Use customer information for the purpose it was collected
Privacy Principle 10 generally limits organisations to using personal information for the purpose it was collected, unless an exception applies. This is particularly relevant when workshop operational data is later considered for unrelated marketing.
Keep privacy decisions practical and documented
- Limit unnecessary access.
- Correct inaccurate customer details.
- Avoid putting private job details into public review responses.
- Review who can export customer information.
- Use current Privacy Commissioner guidance when processes change.