Ask whether the lab acts for itself
The Privacy Commissioner’s decision tree distinguishes sending information to an agent solely for storage or processing from disclosure to an overseas recipient for its own purposes. A buyer licensing material to train its own models needs careful classification; do not borrow an ordinary cloud-hosting conclusion. Prepare a diagram showing who chooses the purpose, who may reuse the corpus, and who can authorise onward access.
Work through principle 12
The Commissioner explains that principle 12 concerns disclosure outside New Zealand and includes routes involving comparable safeguards or a recipient subject to the New Zealand Act. Where the specified protection routes do not apply, the guidance describes a particular informed-authorisation route. Do not reduce that to a generic consent checkbox. Ask counsel to assess the actual recipient and supporting evidence, alongside the permissibility of the underlying disclosure.
Respect provenance beyond legal labels
For community, cultural, or indigenous-language material, identify who contributed it, who can authorise commercial reuse, and what expectations or restrictions accompany it. A privacy analysis alone does not settle collective permissions or intellectual-property questions. Describe dialect, recording context, transcription choices, and exclusions without disclosing identifiable stories in a sales deck. If the corpus concerns a small community, test whether combinations of details reveal individuals despite removed names.
- Document whether the recipient acts only as an agent or has independent uses.
- Record the comparable-safeguards evidence and agreement under review.
- Keep contributor and community permissions linked to source batches.
- Specify model-training rights separately from evaluation access and storage.
Review before release
Sources reviewed on 19 October 2026. This is a preparation checklist, not legal clearance, tax advice, or confirmation that an AI lab accepts suppliers from this jurisdiction. Ask qualified local counsel to review the actual dataset, collection history, proposed training purpose, recipient, and current rules before releasing personal data.