Data Privacy & Digital Rights
Access and correct your personal information, notifiable privacy breaches, privacy complaints, Official Information Act requests, and online harm in New Zealand.
Covered in this guide:
New Zealand's Privacy Act 2020 gives you real control over your personal information through 13 Information Privacy Principles (IPPs). You can access what an organisation holds about you (IPP 6) and ask it to correct mistakes (IPP 7), usually free and within 20 working days. Organisations that suffer a serious data breach must notify the Office of the Privacy Commissioner (OPC) and affected people. Complaints go to the OPC and, if needed, the Human Rights Review Tribunal, which can award damages. Government-held information is accessed under the Official Information Act 1982, and online harm is handled under the Harmful Digital Communications Act 2015.
OPC: 0800 803 909. Online harm (Netsafe): 0508 638 723.
Key Laws
Privacy Act 2020
Public Act 2020 No 31; IPPs; ss 22, 23, 40, 112–117
13 Information Privacy Principles; access and correction rights; notifiable-breach scheme; OPC oversight.
Official Information Act 1982
Public Act 1982 No 156, ss 12, 15
Right to request information held by government agencies; 20-working-day response; Ombudsman review.
Harmful Digital Communications Act 2015
Public Act 2015 No 63, ss 6, 11–12, 22
Tackles serious online harm; Netsafe is the approved agency; District Court orders.
Health Information Privacy Code 2020
Issued under the Privacy Act 2020
Health-specific privacy rules; right to access your health records (Rule 6).
Access Your Personal Information
Information Privacy Principle 6 of the Privacy Act 2020 gives you the right to ask any organisation — business or government — for the personal information it holds about you, and to be told it has th...
Notifiable Privacy Breaches
Since the Privacy Act 2020, organisations have a legal duty to report serious data breaches. Under sections 112–117, if a privacy breach is likely to cause serious harm, the agency must notify both th...
Making a Privacy Complaint
If an organisation has misused your personal information — collected it unfairly, shared it without authority, refused you access, or failed to keep it secure — you can make a privacy complaint. You f...
Correcting Your Personal Information
If an organisation holds information about you that is wrong, out of date, or misleading, Information Privacy Principle 7 of the Privacy Act 2020 gives you the right to ask it to correct that informat...
Official Information Act Requests
The Official Information Act 1982 (OIA) lets anyone request information held by government agencies — ministries, councils (under the parallel LGOIMA), Crown entities. The starting principle is that o...
Health Information Privacy
Your medical and health information gets extra protection under the Health Information Privacy Code 2020, issued under the Privacy Act 2020. The Code applies to GPs, hospitals, specialists, pharmacist...