Is skip tracing legal in New Zealand? What the law allows and where it stops

Skip tracing is the work of locating a person who cannot be reached at the contact details held for them. In New Zealand it is done every day by licensed investigators, recoveries teams, insurers and process servers, and most of it is unremarkable: a debtor who moved without forwarding an address, a beneficiary named in an estate, a witness who changed employers, a defendant who must be served. The mechanics are less dramatic than the name suggests. The legal constraints are stricter than most people expect.

The short answer

Skip tracing is legal in New Zealand. There is no law that prohibits locating a person who cannot be reached at their last known contact details. What the law regulates is how the information is collected, who is entitled to collect it, and what it may then be used for. A trace run for a genuine, declared purpose, using sources the tracer is entitled to access, with results used only for that purpose, sits comfortably within the law. A trace run out of curiosity, using a pretext, or using data the tracer is not entitled to access, does not, regardless of how the result is eventually used.

What a trace is actually made of

A trace starts with what the instructing party already holds. That is usually a name, a date of birth or approximate age, a last known address, and a fragment of something else, an old phone number, an employer, a vehicle registration held on file, a partner's name. Each of those is a weak identifier on its own. The work is corroboration: finding two or three independent records that point at the same person and agree with each other.

The records ordinarily available in New Zealand fall into a few groups. Public registers, such as the Companies Register, the register of incorporated societies and insolvency records, are open to anyone. Land records held by Land Information New Zealand are available on payment. Personal property security interests registered on the PPSR are searchable against a debtor's name. Directory information and publicly available online records are available subject to the conditions attached to it. Credit information, which is often the most current address source in the country, is available only to organisations that meet the access conditions in the Credit Reporting Privacy Code 2020.

A competent tracer works outward from the strongest identifier rather than running every search at once. If the subject has ever been a company director, the register will usually give a residential or service address and a set of related entities. If they own property, the title record gives a name and a legal description that can be tied back to an address history. If neither applies, the trace depends on directory data, credit file address history and the pattern of associations around the subject.

Where traces usually fail

Most failed traces are failed identity matches, not failed searches. Common surnames, transposed dates of birth, an anglicised first name, a married name never recorded, or two people at the same address with the same initials will all produce a confident-looking result for the wrong person. The discipline that prevents this is boring and effective: never act on a single source, and record which two sources agreed before you reported the address. The cost of a wrong match is not just a wasted trip. Serving the wrong person, or telephoning them about someone else's debt, is a privacy breach and often a complaint.

What the law allows

Three regimes matter. The first is the Privacy Act 2020, which governs how any agency collects, holds, uses and discloses personal information. Information principle 1 requires that collection be for a lawful purpose connected with a function of the agency and that the collection be necessary for that purpose. Principle 4 requires collection by means that are lawful and, in the circumstances, fair and not unreasonably intrusive. Principle 10 limits the use of information to the purpose it was obtained for, and principle 11 limits disclosure. Read together, they mean a tracer may search for a person for a proper reason and may not repurpose the result afterwards.

The second is the Credit Reporting Privacy Code 2020, which sits over credit information specifically. It restricts who may access a credit file and for what, requires accuracy and correction processes, and requires credit reporters to log access. If your trace relies on credit data, your access is conditional on meeting those terms, and the log will show what you did.

The third is licensing. The Private Security Personnel and Private Investigators Act 2010 requires a licence or certificate of approval for a person who, for reward, obtains information about another person on behalf of a third party. In practice, an in-house recoveries officer chasing their own employer's debtor is in a different position from a contractor doing the same work for a client. If you are unsure which side of that line your work sits on, take advice before you take the instruction.

What is not allowed

Pretexting, obtaining information by pretending to be the subject, a relative, or an official, is unlawful collection and, depending on the facts, may also be an offence. Accessing a database you are entitled to use for a purpose you are not entitled to use it for is a breach whether or not the search itself was technically permitted. Passing a traced address on to someone with no lawful interest in it is a disclosure breach. Using traced information for marketing, resale or publication is out of scope in every case.

Family and safety matters deserve particular care. Locating a person who has taken steps to avoid being found may put them at risk. A responsible tracer asks who the client is, why they want the address, and whether a protection order or safety concern may be in play, and declines the work if the answers do not hold up. Declining the instruction is the correct outcome where those answers do not hold up.

The record you should be able to produce

Assume that every trace may be reviewed, by a court, by the Privacy Commissioner, by your own client, or by a regulator. That means recording, at the time and not afterwards: who instructed the work, what the declared purpose was, which sources were searched, what each returned, which two sources established the identity match, and what was reported back. A contemporaneous record turns a contested trace into a short conversation.

This is the reason intelID requires an authorised-purpose declaration on every search and writes a complete audit record against the user who ran it. The obligation exists whether or not your tooling helps you meet it; the difference is whether you can prove compliance a year later. You can read more in our guide to authorised purpose under the Privacy Act 2020.

Where intelID fits

intelID consolidates licensed New Zealand sources into one platform, run under one verified account, with the purpose declaration and audit log built into the workflow. See the integrated data sources, how a search runs on the platform page, and the tracing-specific workflow for private investigators. Access is limited to verified, licensed users; you can request access here.