Glossary

Plain definitions of the terms used in New Zealand privacy law and online safety. Each links to the page that explains it in full.

Terms: 32
Checked: 19 October 2026

Access direction

An order from the Privacy Commissioner requiring an organisation to give someone access to their personal information. The Commissioner can issue an access direction after investigating a complaint about a refused or ignored request. It's enforceable through the Human Rights Review Tribunal.

Agency

The Privacy Act's word for any person or organisation that handles personal information, from a sole trader to a government department. It includes businesses, charities, clubs, schools, councils and overseas organisations doing business in New Zealand. Individuals acting purely in their personal or household affairs are generally exempt unless their conduct is highly offensive.

Approved Agency (HDCA)

The organisation appointed to receive and resolve complaints under the Harmful Digital Communications Act; currently Netsafe. Netsafe assesses complaints, works with platforms and the people involved, and can tell you whether a court application is likely to succeed. It can't punish anyone or force them to act.

Biometric processing

Using technology to compare or analyse people's physical or behavioural features, such as faces, fingerprints or voices. Since 3 August 2026 all biometric processing in New Zealand must comply with the Biometric Processing Privacy Code 2025, including a proportionality assessment and limits on inferring emotions or sensitive traits.

Breach register

An organisation's record of every privacy breach and near miss, with its assessment, decision and the changes made. It's the evidence the Privacy Commissioner will ask for when deciding whether an organisation handled a breach properly, including breaches it decided weren't notifiable.

Clean slate scheme

A scheme that automatically conceals some old convictions so people can say they have no criminal record in New Zealand. It applies only if every criterion is met, including no convictions in seven years and no custodial sentence. It doesn't apply overseas or to some jobs, such as Police and judicial roles.

Code of practice

Binding rules made by the Privacy Commissioner that replace or modify the privacy principles for a sector or activity. Current codes include the Health Information Privacy Code 2020, the Credit Reporting Privacy Code 2020, the Telecommunications Information Privacy Code 2020 and the Biometric Processing Privacy Code 2025.

Compliance notice

A notice from the Privacy Commissioner requiring an organisation to do, or stop doing, something to comply with the Privacy Act. The Commissioner said in 2026 it intended to issue compliance notices to Manage My Health and Health NZ after its inquiry into the portal breach.

Credential stuffing

Using usernames and passwords leaked from one website to break into accounts on other websites. It works because people reuse passwords. A password manager and two-step verification defeat it.

Credit file suppression

A free freeze on your credit file that stops credit reporters releasing your information to lenders, making it hard for someone to borrow in your name. In New Zealand, one request to Centrix or Equifax can be passed to the other credit reporters. The initial period is short, so set a reminder to extend it.

Doxxing

Publishing someone's private details, such as their home address or workplace, usually to encourage harassment. There's no specific doxxing offence in New Zealand, but it can breach the Harmful Digital Communications Act, the Harassment Act or, for organisations, the Privacy Act.

Harmful Digital Communications Act 2015

New Zealand's law on online harm, with ten communication principles, a free complaints service through Netsafe, court orders and criminal offences. Posting a digital communication intending to cause serious emotional distress can be punished by up to two years' imprisonment or a $50,000 fine. Sharing intimate visual recordings without consent is a separate offence.

Human Rights Review Tribunal

The tribunal that can decide privacy claims and award damages, usually after a Privacy Commissioner investigation. It can award damages for financial loss and for humiliation, loss of dignity and injury to feelings.

Indirect collection (IPP 3A)

Collecting someone's personal information from anyone other than them, which since 1 May 2026 usually means telling them. Information privacy principle 3A requires reasonable steps to make sure the person knows six matters, unless an exception applies, such as the information being publicly available.

Information privacy principles (IPPs)

The fourteen rules in section 22 of the Privacy Act 2020 that govern collecting, storing, using and sharing personal information. There were thirteen until IPP 3A was added from 1 May 2026. They cover purpose, source, notice, manner of collection, security, access, correction, accuracy, retention, use, disclosure, overseas disclosure and unique identifiers.

Intimate visual recording

A recording of someone naked, in their underwear or doing something intimate, in circumstances where they'd expect privacy. Making one covertly, or sharing one without consent, is a criminal offence. A 2026 bill proposes extending the definition to images that are created, synthesised or altered, such as deepfakes.

Māori data sovereignty

The idea that Māori have inherent rights and interests in how data about Māori people, communities and taonga is collected, owned and used. It goes beyond individual privacy to collective interests. Te Mana Raraunga, the Māori Data Sovereignty Network, has set out principles for it.

Multi-factor authentication (two-step verification)

Signing in with something extra besides your password, such as a code from an app, a passkey or a security key. It stops most account takeovers that use stolen passwords. Passkeys and authenticator apps are stronger than text message codes.

Notifiable privacy breach

A privacy breach that it's reasonable to believe has caused, or is likely to cause, serious harm, and must be reported to the Privacy Commissioner and affected people. The Commissioner expects notification within 72 hours of becoming aware, through NotifyUs. Failing to notify the Commissioner is an offence with a fine of up to $10,000.

Passkey

A replacement for passwords that uses a key stored on your device, unlocked with your face, fingerprint or PIN, and can't be phished. Passkeys only work on the real website they were created for, which makes fake login pages useless.

Personal information

Under the Privacy Act, any information about an identifiable individual, including opinions, images and recordings. It doesn't need to be secret or sensitive. Information can be personal if it identifies someone when combined with other information the holder has.

Phishing

Messages that pretend to come from a trusted organisation to trick you into clicking a link, entering a password or paying money. Phishing by text message is often called smishing, and by phone, vishing. QR code phishing, where fake codes lead to fake sites, is growing in New Zealand.

Privacy impact assessment (PIA)

A structured review of a project's privacy risks, done before it's built, so problems can be fixed cheaply. The Privacy Commissioner expects PIAs for new AI tools, biometric processing and significant changes in how personal information is handled.

Privacy breach

Unauthorised or accidental access to, or disclosure, alteration, loss or destruction of, personal information, or anything that stops the organisation accessing it. Defined in section 112 of the Privacy Act. Ransomware that only locks files is still a breach.

Privacy Commissioner

New Zealand's independent privacy regulator, which handles complaints, issues guidance and codes, and can investigate and take compliance action. Its Poupou Matatapu guidance sets out what good privacy practice looks like for organisations.

Privacy officer

The person every New Zealand organisation must have to encourage Privacy Act compliance, handle requests and work with the Commissioner. It can be part of someone's job, and the role can be filled by someone outside the organisation.

Rating information database

A council's database of properties for rating, which by law includes owners' names and postal addresses unless an owner asks for them to be withheld. Under section 28C of the Local Government (Rating) Act 2002, any owner can ask in writing to withhold their name, postal address or both, without giving a reason.

Sextortion

Threatening to share intimate images of someone unless they pay or send more images. It's a crime, often run by organised overseas groups, and frequently targets teenage boys. Don't pay, stop replying, keep evidence and contact Netsafe and Police.

SIM swap

When a criminal persuades a phone company to move your number to their SIM card so they receive your calls and text codes. Ask your mobile provider to add a PIN or password to your account, and prefer passkeys or authenticator apps over text codes.

Stalkerware

Monitoring software secretly installed on someone's phone to track their location, messages or activity. It usually needs physical access to an unlocked phone. If you suspect it, plan any changes with a family violence advocate, because removing it can alert the person who installed it.

Unpublished electoral roll

A confidential electoral roll for people whose safety, or whose family's safety, could be put at risk by publishing their name and address. Under section 115 of the Electoral Act 1993, the Electoral Commission decides applications on their merits. People on it cast special votes.

Working day (Privacy Act)

Any day except weekends, listed public holidays, Mondayised Waitangi and Anzac Days, and the period from 25 December to 15 January. Defined in section 7 of the Privacy Act 2020. It's used to count the 20 working days an organisation has to respond to a request.