Our website uses cookies to give you the best experience and for us to analyse our site usage. If you continue to use our site, we will take it you are OK about this. Click on More for information about the cookies on our site and what you can do to opt out.

We respect your Do Not Track preference.

Your privacy

  • Download the Complaint Form.
  • You don't have to fill in a complaint form - you can put it in a letter instead. But please read the notes below to give you guidance on what information we will need so we can consider your complaint.
  • If you're unsure what to do, just contact our enquiries line (Phone 0800 803 909) or email, and our staff will help you.

What information do we need to know?

1. Your name and contact details

We need to keep in contact with you while we are considering your complaint. Since you may not want other people to know that you have made a complaint, give us an address, phone number or email address where we can contact you confidentially.

2. (a) The name and contact details of the person and/or organisation ("the agency") about whose actions you are complaining

If you believe that someone has breached your privacy, and you want us to investigate what has happened, we will need to talk to that person, and/or the agency they work for. This is so that we can get their view of what has happened.

2. (b) What is your relationship to that agency (eg employee, client, family member, patient)?

We need to know the context of the dispute. This helps us to see how the law might apply to that situation.

3. Have you already contacted the agency about your complaint?

Before coming to us, you should contact the person or organisation and try to sort the problem out with them.

If the organisation has a privacy officer, that is the best person to talk to. If the agency doesn't have a privacy officer, talk to someone senior, like the manager.

If you are not satisfied with the agency's response, then send in a complaint. Give us as much relevant information as you can - this will speed up any investigation.

Include with your complaint form:

  • Copies of all letters/emails/other documents you have written and received about your complaint

If you don't have anything in writing, tell us:

  • Who you spoke to
  • The date you spoke to them
  • What you said
  • What their response was.
4. What types of action would resolve your complaint?

Think about what would make the problem go away for you. This gives us the ability to see whether the agency would agree to settling the dispute.

People ask for different things:

Maybe an apology is in order. This is all that many people want. You may want a promise that the same thing won't happen to you again - or that it won't happen to someone else. Maybe a meeting with the agency would resolve the problem. You may be able to think of something else which will allow you to move forward.

Sometimes, people get confused about what the Commissioner has power to do. For example:

  • he can't force an agency to pay compensation
  • he can't order that an agency sack someone
  • he doesn't prosecute people.

See our Frequently Asked Questions for some further information on the Commissioner's powers to resolve complaints.

5. What is the complaint about?

This information helps us to advise you and the agency on how the law applies to your case.

Tell us exactly what it is that the person or agency has done that you think breaches your privacy.

A complaint that involves only one area of law is just as serious as one involving many areas of law. So do not feel that you have to tick many boxes. Only choose what is relevant to what has happened.

If you can focus clearly on what your complaint is about, we will be able to consider it more quickly.

The check boxes indicate the most common areas of complaints. For more information about what each check box means, click on the links below.
(a) access
(b) correction.

If you tick these boxes, make sure you give us copies of your request for access or your request for correction. Also give us copies of the agency's responses.

If you don't have anything in writing, give us details of:

  • who you made the request to
  • what exactly the request was for
  • the date you made the request
  • what their response was.

(c) disclosure
(d) use
(e) collection
(f) security
(g) other.

In each of these cases, tell us exactly what information was disclosed/used etc. Give us background information or documents to show what happened. For example, tell us who the information was disclosed to and why, or who collected it and why.

6. Explain how this action/these actions have caused, or may cause, a negative effect on you (with evidence where available)

Under the Privacy Act, an interference with privacy usually only occurs when an agency has breached a privacy principle, and also has caused some sort of harm.

The only exceptions are in cases involving access and correction, where harm is not relevant.

Harm can be:

  • Financial loss, or injury
  • Adverse effect on a person's rights, benefits, privileges, obligations or interests, or
  • Significant humiliation, significant loss of dignity, or significant injury to feelings.

Breaches of the privacy principles are serious, and should be brought to the attention of the Privacy Commissioner. Even if - legally speaking - there's no "interference with an individual's privacy", the Commissioner still encourages agencies to improve how they deal with personal information.

But if the Commissioner is going to make a formal finding in your favour, you will need to show us that you have suffered, or may suffer, harm.