Our website uses cookies so we can analyse our site usage and give you the best experience. Click "Accept" if you’re happy with this, or click "More" for information about cookies on our site, how to opt out, and how to disable cookies altogether.

We respect your Do Not Track preference.

down arrow
251007 IPP3A coworkers

Learn about IPP3A

On 1 May 2026 IPP3A will come into force and all organisations will need to have their systems in place to comply with the new requirements by then. Read our IPP3A 'focus area' page that will help you find your way through.

If an agency has collected personal information indirectly, IPP3A requires them to take reasonable steps to make sure that the person concerned is told:

  • that the information has been collected
  • the purpose of the collection
  • the intended recipients of the information
  • the name and address of the agency that is collecting the information and the agency that holds the information
  • whether the collection is authorised or required by law and which particular law
  • their right to access and correct their information.

Questions? Email us at IPP3A@privacy.org.nz

Privacy breach homepage

Make a privacy complaint

We're keen to work with New Zealanders to get their privacy queries and complaints sorted quickly and fairly. Before you complain to us, you need to complain directly to the business or organisation that you feel has breached your privacy.

If you haven’t been able to work out your privacy issue with them, then you can complain to us. We aim to ensure that you're treated fairly, whatever your background or circumstances. We work in accordance with the Human Rights Act 1993.

Being affected by a privacy breach can be distressing and emotionally harmful. Read about managing your mental distress.

We review all the complaints we receive. If we can resolve them quickly, we will. If your case requires a complicated or comprehensive investigation, then owing to high volumes, the wait time for an investigator is at least six months, and likely longer. Another agency may be able to help you quicker than that. See our list of other dispute resolution schemes

Agencies: report a data breach

If you're an organisation and have a privacy breach that is likely to cause anyone serious harm, you are legally required to notify us and any affected persons as soon as you can.

As a guide, our expectation is that a breach notification should be made to our Office no later than 72 hours after agencies are aware of a notifiable privacy breach. Work out whether you need to notify us.

How long is 72 hours(external link)?

Do I need to notify my privacy breach(external link)?

elearning homepage image

Use our free e-learning tools

We can help you and your workmates learn about privacy, or sharpen your skills with our free e-learning tools. There are 10 free courses to choose from, and they are all run as online learning modules. Learn at your own pace and receive a certificate of completion.

Topics range from Privacy 101 to specialist topics like health and education. You can learn more about reporting privacy breaches, approved information sharing agreements (AISA) and more.

Get learning with our e-learning modules(external link).

110325 statement of intent

Come and work with us

When you work here you’re serving New Zealanders and their right to privacy. We’re a small but mighty Office full of well-read people who are interested in the world and what happens in it. Kindness matters here, which creates a great place to work. Find out more about working here, check for vacancies, and read about our recruitment process.