How New Zealand actually works, privacy

Privacy, your information and the rules around it

Every form you fill, camera you pass, and record the council keeps about you sits inside one statute: the Privacy Act 2020. It doesn't promise privacy as a wall, it promises rules about what agencies may collect, what they must tell you, what you can see, and what happens when they lose it.

What it is

The Privacy Act 2020 governs personal information, anything about an identifiable individual, held by agencies, which in this law means almost everyone: government departments, councils, companies, clubs and landlords alike. It replaced the 1993 Act on 1 December 2020, Privacy Act 2020.

Its engine is a set of thirteen information privacy principles, the IPPs, which every agency must follow. Every agency must also name a privacy officer: at least one person whose job includes knowing these obligations.

The principles in five moves

Collecting (IPP 1–4), only collect what you genuinely need, for a lawful purpose connected to your work; collect it from the person themselves where possible; tell them you're collecting it and why; and don't collect it by unfair or unreasonably intrusive means. New since May 2026: IPP 3A, if you collected the information indirectly (from someone other than the person it's about), you still owe them the notification.
Keeping it safe (IPP 5), reasonable security against loss, misuse and unauthorised access.
Your two rights (IPP 6–7), you can ask to see what an agency holds about you, and ask to correct it; if they won't correct it, they must attach your statement of what you say is wrong.
Using it (IPP 8–11), check it's accurate before using it, don't keep it longer than needed, use it only for the purpose it was collected, and don't hand it on without a reason the Act names (consent, the original purpose, legal requirement, or preventing serious harm).
Identifiers (IPP 12–13), don't give people unique identifiers the law hasn't assigned, and be careful matching datasets, Privacy Commissioner, the principles.

When they lose it

A privacy breach that causes, or is likely to cause, serious harm is a notifiable privacy breach: the agency must tell the Privacy Commissioner as soon as practicable, and must tell the people affected unless an exception applies. Failing to notify the Commissioner is an offence, the 2020 Act's sharpest new tooth. The Commissioner's NotifyUs tool exists precisely because "is this serious enough to report" is the question everyone freezes on.

The Commissioner's other new power: compliance notices, a formal instruction to an agency to do something, or stop doing something, when the Act is being breached. No court trip required.

The referee

The Privacy Commissioner, an independent Crown entity, investigates complaints, tries conciliation first, and can issue compliance notices and access directions compelling an agency to hand over your own information. Complaints that can't settle can end up at the Human Rights Review Tribunal, which can award damages, including for humiliation and injury to feelings, the remedy the Act takes seriously enough to name.

Sector-specific codes of practice modify the Act for credit reporting, health information, telecom metadata and more, same statute, tuned rules.

In Christchurch

The council is an "agency" like any other, its CCTV network, the ANPR cameras, your rates record and your LGOIMA requests all live inside these principles. That's why the OIA's withholding grounds include privacy: the two statutes meet in the same filing cabinet, the OIA explainer covers the asking-for-it side.

And the cameras' other half, who watches, and who watches the watchers, is this site's own surveillance page. The Privacy Act is the rules-of-the-road under both.

Primary sources

The language

Personal information: Anything about an identifiable individual, the Act's whole jurisdiction in four words.
Agency: Whoever holds the information, departments, councils, companies, clubs. Almost everyone is one.
IPP: Information privacy principle, the thirteen rules (plus the new 3A) every agency must follow from collection to deletion.
IPP 3A: The May-2026 addition, agencies that collected your information from a third party must still tell you they hold it.
Notifiable breach: A privacy breach likely to cause serious harm, must be reported to the Commissioner and usually to you.
Compliance notice: The Commissioner's direct order to an agency, do this, or stop doing that, no court needed.
Access direction: A binding order to hand over the information an agency holds about you, when asking politely failed.
Code of practice: A sector-specific tuning of the Act, credit reporting, health information and friends, issued by the Commissioner and legally binding.

The Canterbury of it

The country's biggest privacy workload was a Christchurch one. After the earthquakes, thousands of householders exercised their IPP 6 right, ask to see your own file, on EQC at once: incoming requests jumped from 50–70 a week to more than 160, and by 2013 the commission was quoting waits of six to seven months. The Chief Ombudsman and the Privacy Commissioner investigated jointly and published Information fault lines Ombudsman, Information fault lines, 2013. Behind the counter the data moved the other way too: EQC gave private insurers expanded access to its claims system to speed settlements, and Parliament later wrote EQC-to-insurer disclosure into the EQC Act itself, over the Privacy Commissioner's public objections to how the clause was drafted Natural Hazards Commission, EQC data briefing Privacy Commissioner, submission on the EQC Amendment Bill, 2018.

And the sharpest information-control decision of the era was about footage of this city: days after the 15 March 2019 mosque attack the Chief Censor called in the livestreamed video and the attacker's document and classified both objectionable, possessing or sharing them became a criminal offence, and internet providers voluntarily blocked the hosting sites DIA, response to the Christchurch terrorism attack video. The Classification Office defended the ban partly on privacy grounds, those who died, it said, were entitled to the dignity privacy affords Classification Office, response to Christchurch.

Last reviewed 20 September 2026, sources: legislation.govt.nz (Privacy Act 2020), privacy.org.nz (the IPPs, breach notification, compliance notices), dns.govt.nz. Corrections: /corrections.

Questions, answered briefly

How do I see the information an agency holds about me?

Ask for it, IPP 6 gives you the right to see what an agency holds on you and IPP 7 the right to ask for a correction; if they will not correct it, they must attach your statement of what you say is wrong. A refusal or no answer is a complaint to the Privacy Commissioner, who can issue a binding access direction.

What is a notifiable privacy breach?

A breach that causes, or is likely to cause, serious harm: the agency must tell the Privacy Commissioner as soon as practicable and must tell the people affected unless an exception applies. Failing to notify the Commissioner is an offence, the 2020 Act's sharpest new tooth.

Who does the Privacy Act 2020 apply to?

Almost everyone who holds personal information, government departments, councils, companies, clubs and landlords are all "agencies" under it. Each must follow the thirteen information privacy principles and name a privacy officer.

What powers does the Privacy Commissioner have?

It investigates complaints, tries conciliation first, can issue compliance notices ordering an agency to do or stop doing something without going to court, and can compel release of your own information. Complaints that cannot settle can end at the Human Rights Review Tribunal, which can award damages including for humiliation.