The Government Communications Security Bureau Act 2003, as amended in 2013, sets out the functions of the GCSB and makes provision for its administration and the conduct of its operational activities. Oversight of the GCSB's activities is set out in the Intelligence and Security Committee Act 1996 and the Inspector-General of Intelligence and Security Act 1996.

On 15 April 2013, Prime Minister and Minister Responsible for the GCSB, the Rt Hon John Key, announced proposed legislative changes to the GCSB Act 2003 and to the oversight regime of the New Zealand Intelligence Community. Amendments to legislation took effect on 27 September 2013.

The amendments to the GCSB Act 2003 made changes to the objective, functions, and limitation provisions to improve clarity about the legal basis for the GCSB’s activities and to accommodate changes in the prevailing security environment, particularly in relation to cyber security and information security. For the first time, the GCSB is required to formulate a policy on personal information and the Privacy Commissioner has a new oversight role, both in the development and review of that policy and also subsequent audits of compliance. Importantly, the restriction that has always prevented the GCSB from targeting New Zealanders remains in place in respect of foreign intelligence gathering.

The GCSB is also subject to all New Zealand law, although specific exemption provisions are contained in some legislation, such as the Privacy Act 1993, the Public Finance Act 1989, and the Radio Communications Act 1989. Other more general exemptions also exist, including in the Human Rights Act 1993 and the Public Records Act 2005.