About OPC

A Māori man with black curly hair and an arm tattoo is talking on a cellphone. He wears a blue t-shirt and has a laptop open in front of him. This privacy statement explains how the Office of the Privacy Commissioner (OPC) collects, stores, uses and shares your personal information.

The Privacy Act 2020 requires us – like any other New Zealand agency – to tell you certain things about the personal information we need to carry out our functions. This is where we explain our privacy practices and why you can trust us to handle your information with care and respect.

Openness and transparency are important to us

If you find a security issue within our online systems please tell us about it so we can get it fixed. We acknowledge receipt as soon as possible and within 7 working days we will give you an update on the progress of our investigation.

Read our Vulnerability Disclosure Policy that outlines how we will work with anyone who tells us about vulnerabilities in our system.

'Compliance' and 'Engagement'

We have categorised our statutory functions into two broad groups: 'Compliance' and 'Engagement'.

Under these groups, we explain what personal information we collect and how we use or share it. We also explain about the way we store and protect personal information and your rights to access and correct it.

We only collect personal information where this is necessary to carry out our functions.
We may collect personal information about you either directly from you or from other people or agencies, and we may generate personal information about you when we carry out our functions.
We store all our data (including your personal information) on a secure Microsoft Azure cloud platform and we use Microsoft Office 365 applications. We protect our data with all reasonable technical and process controls.
You can ask us for a copy of your personal information at any time. We will be as open as we can with you but must also ensure we meet our secrecy obligations.
We will only use and share personal information where necessary to carry out the functions for which we collected it, or if required by law.

If you cannot find the information you need, or you have concerns about the way we are managing your personal information, please contact us.

What information do we collect in our activities?

Compliance: see what personal information we collect when we investigate complaints, initiate inquiries, or handle privacy breach notifications, and what we do with it

Engagement: the personal information we collect from enquiries, submissions, e-learning, events and our website, and what we do with it:

Storage and security: where we store your personal information and how we protect it:

Your privacy rights and how to contact us

NOTE: We may update this privacy statement, for example to reflect changes to the Privacy Act. This statement was last updated in November 2020.