The SIS had suspected Hager was illegally given information by a member of the Defence Force for his 2011 book Other People's Wars - which raised the possibility of civilian casualties in Operation Burnham.
It seized two months' worth of his home phone's metadata, aiming to track down the NZDF member.
However, in 2019 the Acting Inspector General of Intelligence and Security found the SIS had no reasonable grounds for suspecting espionage, and failed to show the necessary caution for investigating a journalist's source in a free and democratic society.
The phone data showed no link between Hager and the suspected NZDF member. It was found to be a breach of Hager's privacy.
"Mr Hager had a reasonable expectation of privacy in his home telephone, and NZSIS now accepts that it acted unlawfully in obtaining that data," a public statement by the SIS, dated 22 November said.
"Accordingly, NZSIS apologises unreservedly for breaching Mr Hager's rights. Its conduct fell short of its own expectations."
The settlement was conditional on the SIS publishing an assurance it did not share the data with any third parties, it would delete Hager's data within two months, and the statements it made were true and accurate.
The documents were signed by Hager and SIS director Rebecca Kitteridge, who is due to leave the role to take up a position as deputy public service commissioner from March.
The settlement out of court agreed Hager would be paid $40,000 in compensation, along with $26,400 in legal fees.
In a written statement, Hager said he was pleased with the result but more needed to be done to prevent illegal actions by the SIS and others.
His lawyer, Felix Geiringer, said he was dubious about the SIS's claims it had reformed its policies since seizing Hager's records, with the organisation refusing to make its new media policy public.
"The NZSIS needs a clear policy stating when the use of its powers against a journalist would be justified. There also needs to be a rule that only someone sufficiently senior in the organisation can make such a decision. And there is no basis for keeping such a policy secret."
Today's statements were a "more forthright acceptance" that the SIS had broken the law, and how it had done so, than when the Inspector-General's findings were released in 2019, he said.
It fell short, however, of they really wanted - to know it would not happen again.
"I would encourage those in charge to be looking at this yet again and saying 'look, it's time we actually set down in writing for everybody to read what it is that prevents us from breaking the law in this way, how we're going to have sufficiently senior people in charge of it'," Geiringer said.
"If people know that if they reveal important information to journalists that they're going to be identified and potentially punished for it then they're simply not going to reveal that information, and the public's not going to receive it."
