Your rights

Our Office values working with New Zealanders to get their privacy queries and complaints sorted quickly and fairly. Before you complain to us, you need to complain directly to the business or organisation that has breached your privacy.

How complaining to us works

If you haven’t been able to work out your privacy issue with the business or organisation you complained to, then you can complain to us.

First, we’ll decide whether we need to investigate. We will base that decision on the information you provide, so it’s helpful to set out a short explanation for what your key concern is and include only relevant documents. If we decide to investigate, we may first talk to you and sometimes to the agency you’re complaining about.

Read our decision guide.

We will try to accommodate any accessibility needs you have when contacting us in accordance with the Human Rights Act 1993.

Reasons we won't investigate

There are many reasons we won’t investigate (some are listed below) but even if we decide we can’t, we’ll still give you a chance to comment.

Some common reasons we won’t investigate are:

You haven't contacted the organisation first
You should give the business or organisation a chance to resolve your problem first and should wait at least 30 working days for a response before contacting us.

Your complaint is about an old issue
If your complaint is about something that happened more than 12 months ago, we probably won’t investigate it unless there’s a good reason why you didn’t contact us earlier.

The issue hasn't caused you harm
We’ll only investigate a breach of your privacy if it’s caused you harm.

The agency has taken appropriate steps to resolve the issue
If an agency has already acted, changing its systems, and apologising to the person concerned, we’d likely consider those actions that would resolve the complaint. An investigation isn’t likely to achieve a different outcome.

Section 74 of the Privacy Act has a full list of reasons we might not investigate your complaint and includes things like the complaint being a breach of someone else’s privacy, or there being a better way to sort it out.

Complaining to us with courtesy and consideration

We take the health and safety and wellbeing of our staff seriously and have some rules of engagement that we’d like you to know about.

You can expect us to:

treat you courteously and with respect
answer your questions about our process
keep you informed about your complaint and when you can expect to hear back from us.

We expect you to:

treat us with courtesy
co-operate with our process and requests for information
correspond with our staff politely and in a way that maintains staff wellbeing
accept that we will not tolerate rude or abusive behaviour or correspondence that undermines staff wellbeing
understand that we have a zero-tolerance approach to threats made to OPC staff.

As an agency that deals with human rights, we value feedback. However, harmful communications to OPC staff – such as abusive or offensive comments and harassment – are never acceptable and may result in the Office declining to investigate your complaint.

Read our service charter that explains this in more detail.

OPC takes the safety and wellbeing of our staff seriously

Violence or threats of violence are not tolerated, and we will respond accordingly. This may include issuing a warning, limiting access to our services, reporting a matter of concern to the Police, or issuing a trespass notice. OPC may use or disclose your personal information to the Police or to a complaints body, to report threats of violence or offensive communications. This will be done as it is necessary for the safety and wellbeing of our staff.

Read our policy for responding to threats to staff safety.

Inappropriate or offensive communication with our staff may result in a warning or may mean that we are not able to deal with your complaint.

This includes:
- abusive or offensive comments or threats to OPC staff
- intimidation or harassment of OPC staff by phone or email
- inappropriate questions to OPC staff or referencing non-relevant OPC staff personal information
- threats to defame OPC staff or to publish personal information about OPC staff
- posting personal information about OPC staff online, including any communication that breaches the communication principles in the Harmful Digital Communications Act.

What we can't do
Our role is to decide if there’s been a breach of the Privacy Act and help both the groups come to a decision. We can't force organisations to pay you money, issue fines, make anyone accept a settlement offer, or force anyone to accept our findings.

Getting your personal information corrected
If you make a request to an agency about accessing or correcting your personal information, they must respond to that within 20 working days. Any agency may, in limited circumstances, extend the 20-working day timeframe, but they must tell you why, and let you know when they’ll give you the information. You can use our response calculator on the left to work out the latest date an agency must respond to you by.

One person complaining on behalf of many
When lots of people are affected by one privacy breach, the Privacy Act allows for one person to make a complaint to us on behalf of many (as a class). When this happens, the Privacy Commissioner can begin an investigation themselves.

Giving someone authority to act on your behalf
If you want someone to act on your behalf (like an advocate, a family member, or lawyer) you will need to complete a form that tells us that in writing.

Open the Representative Authority Form in Word

Open the Representative Authority Form in PDF

Other places you can get help
We can only investigate the privacy aspects of your complaint.
Our list of other regulators and dispute resolution schemes may help you find other agencies who can better help you.

Make a complaint