Your rights under the Privacy Act

The Privacy Act 2020 applies to almost every organisation that holds information about you, including businesses, charities, schools, clubs, government departments and councils. It also applies to overseas companies doing business in New Zealand. These are the rights it gives you.

The right to know what they hold

You can ask any organisation for the personal information it holds about you. This is information privacy principle 6. You don’t need to give a reason, use a form or mention the Act.

They must respond as soon as reasonably practicable, and no later than 20 working days after receiving your request. Working days exclude weekends, public holidays and everything from 25 December to 15 January. Our deadline calculator works out the exact date.

Personal information covers a lot, including emails that mention you, notes about you, CCTV footage of you, call recordings, opinions about you, and information held by a supplier on the organisation’s behalf.

They can refuse some information for reasons listed in the Act, such as where releasing it would reveal someone else’s private information or would endanger someone’s safety. If they refuse, they must tell you why and that you can complain.

How to ask: our request letter builder writes the letter. The Privacy Commissioner’s AboutMe tool can send it for you.

The right to correct it

If information about you is wrong, you can ask for it to be corrected (principle 7). If the organisation won’t correct it, you can ask it to attach a statement of the correction you asked for, so anyone reading the record sees both.

The right to be told

When an organisation collects information from you, it should tell you why, who it will share it with, and how you can see and correct it (principle 3). Since 1 May 2026 the same applies when it collects information about you from someone else (principle 3A), unless an exception applies. If you discover an organisation has information about you that you didn’t give it, ask where it came from.

Limits on what they can do with it

Organisations should only collect what they need for a lawful purpose (principle 1), collect it fairly and without being unreasonably intrusive (principle 4), keep it secure (principle 5), keep it accurate (principle 8), keep it no longer than needed (principle 9), use it only for the purpose they collected it for, with some exceptions (principle 10), and disclose it only in limited circumstances (principles 11 and 12).

New Zealand law doesn’t currently give you a general right to have your information deleted on request, unlike Europe’s GDPR. The Privacy Commissioner has called for a right to erasure to be added. In the meantime, principle 9 still means organisations shouldn’t keep information longer than they need it, and asking them to delete it often works.

The right to be told about serious breaches

If an organisation has a privacy breach that’s likely to cause you serious harm, it must tell you, and the Privacy Commissioner, as soon as practicable, with limited exceptions.

When an organisation won’t play fair

1. Complain to the organisation first, preferably its privacy officer. Every organisation must have one. Say what happened, how it affected you, and what you want, such as an apology, a correction, deletion, a change of practice or compensation.
2. Complain to the Privacy Commissioner if you’re not satisfied. It’s free. The Commissioner’s office tries to resolve complaints by agreement, and can issue an access direction if an organisation won’t release your information. Expect delays, because the Commissioner’s website notes high demand.
3. The Human Rights Review Tribunal can award damages for interference with privacy, including for humiliation, loss of dignity and injury to feelings. Getting there usually follows a Commissioner investigation. A lawyer helps here; Community Law centres can advise for free.

A note on time limits

The Commissioner doesn’t usually investigate complaints about things that happened long ago, and organisations don’t keep records forever. If something has gone wrong, act within a few months while evidence still exists.