Privacy is a fundamental human right. One of its most important aspects is information privacy – providing individuals with control over the way in which their personal data is collected, used, disclosed and otherwise handled. Existing information privacy regulation neither recognises nor protects the collective privacy rights of Indigenous peoples. This paper explores Indigenous data privacy, and the challenges and opportunities, in the context of Aotearoa. It has two aims: to identify gaps in existing data privacy approaches with regards to Indigenous data, and to provide a foundation for progressing alternative privacy paradigms. We argue that while personal data protection is necessary, it is insufficient to meet the needs of Māori and Aotearoa more broadly. In so doing, we draw on three areas of research: Indigenous and Māori data sovereignty; data and information privacy, including collective privacy; and Māori and Indigenous privacy perspectives. We examine key features of the Aotearoa privacy context – including the Privacy Act 2020 (NZ) – and consider the implications of te Tiriti o Waitangi and tikanga Māori for alternative privacy approaches. Future options, including legal and extra-legal measures, are proposed.