Our website uses cookies so we can analyse our site usage and give you the best experience. Click "Accept" if you’re happy with this, or click "More" for information about cookies on our site, how to opt out, and how to disable cookies altogether.

More Accept ×

We respect your Do Not Track preference.

Close ×

opc header logo

Your privacy rights

Print | Email this page

Complain to the Privacy Commissioner

This page shows you the steps to take to complain to the Privacy Commissioner. Read about how we work to settle complaints.

We help sort out issues about personal information and your right to privacy. The laws about privacy are outlined in the Privacy Act; they say how agencies need to protect the collection, storage, use and sharing of personal information.

We will try to accommodate any accessibility needs you have when contacting us in accordance with the Human Rights Act 1993. 

Step one: Complain to the agency you think interfered with your privacy 

First, you need to try and work out your privacy issue with the agency (business or organisation) you think interfered with your privacy. Use our online form to complain to another agency or contact them yourself. We recommend contacting the agency in writing and keeping a copy of that in case you need to send it to us later.  

EXAMPLE: See what a good complaint looks like or use our words (opens to PDF, 956KB).

If you haven’t been able to work out your concerns with the agency, then you can move to step two.

TIP: We won't accept a complaint to the Privacy Commissioner if you haven't done step one.

Step two: Check if we’re the right agency to help you with this complaint 

We understand that privacy might only be a small part of a broader dispute. There may be a better place to complain to. 

Employment disputes may also include privacy concerns. However, if you are currently engaged in an employment dispute and you have told us that you are also filing an application with the Employment Relations Authority, then we can’t investigate while that happens. Try Employment Relations Authority or Labour Inspectorate.

Health agency concerns, such as how you were treated by a medical professional can be raised with the Health and Disability Commissioner.

Central or local government agency decisions, actions, or omissions that you are concerned about can be raised with the  Office of the Ombudsman.

Tenancy issues can be raised with the Tenancy Disputes Tribunal.

If someone said something about you online that you didn’t like then contact Netsafe.

See a list of other dispute resolution schemes that you can use for free.

Step three: Get your evidence ready

To help us help you, we need to see good evidence that clearly shows us what happened. 

We love to hear from people in their own words. However, we also know that using AI is a fast way to get a job done. Read about why you should be cautious using AI to help you.

Get your evidence ready before you start the complaint form because you can’t save your application and return to it later. You will need to provide: 

TIP: We need to see dates, timestamps, sender and recipient details. We recommend sending us PDFs of any emails. 

Step four: Complete your online assessment

To complain to us you need to complete this online self-assessment.

It steps you through whether your complaint is one we’re able to investigate and/or if there is any action you need to take first.

If you meet the criteria for complaining, then you will need to provide us with your evidence so we understand your complaint. Once you start the form you can’t save your application and return to it later, so make sure your evidence is ready to be uploaded. 

If you do not provide us with sufficient evidence of the issue and that you have tried to resolve your complaint with the agency, we may not be able to assess your complaint. Write your complaint concisely, clearly, and with a focus on resolution. 

All complainants will need to agree to comply with our Service Charter and our Managing Unreasonable Conduct Policy. We also consider that unreasonable conduct includes making unreasonable demands, or not engaging with our Office in good faith.

We will not tolerate rude, abusive, or unreasonable behaviour towards our staff. We take the safety and wellbeing of our staff seriously. Violence or threats of violence will not be tolerated. We may give you a warning, limit access to our services, report a matter of concern to the Police, or issue a trespass notice. 

If we need to report your threats of violence or offensive communications to Police or another complaints body, we might need to disclose your personal information. This will be done as it is necessary for the safety and wellbeing of our staff. 

Read our policy for responding to threats to staff safety. 

Step five: We’ll assess your complaint and decide if we will investigate 

We will review every complaint we receive. We may not take action on every complaint we receive. If you have not provided sufficient evidence, we will not likely respond. 

We will assess whether there is an apparent interference with your privacy and decide any appropriate next steps in line with our 30-page decision guide (opens to PDF, 394KB). You don’t need to read this to have your concerns heard and understood. 

If your case requires an investigation, the wait time for an investigator is up to twelve months owing to high volumes. Our investigators are experts in the Privacy Act, and want to help you settle your complaint. 

Sometimes there are reasons we won’t or can’t investigate. The common reasons we won’t investigate are:

  • You have not made reasonable efforts to resolve your complaint directly with the agency.
  • You have not provided sufficient evidence about your complaint. 
  • You have not reached our harm threshold. For most of the privacy principles, to make a complaint, the issue needs to have caused you harm, and we need to see evidence of that. You don’t need to demonstrate harm for access and correction complaints, but you do for all the other principles.
  • We do not have jurisdiction to investigate your complaint, or you have an alternative dispute resolution process available to you to resolve the complaint. Check if we are the right agency to make your complaint to in step 2. 

There are also some things we can't help you with:

  • Obtaining preservation notices or privilege logs.
  • Forcing an agency to give you money.
  • Issuing access directions, fines or compliance notices without investigating the issue first. 

We help parties try to resolve complaints. One of the ways we can do this is to decide if there’s been an interference with an individual’s rights under the Privacy Act. We can't issue fines, make anyone accept a settlement offer, force organisations to pay you money, or force anyone to accept our findings.

What happens when we accept your complaint?

If we are the right agency to help you resolve a complaint quickly, we will. There are ways we can help you resolve your complaint without investigating. If we do take action we might:

  • Make a preliminary enquiry with the agency.
  • Send a Compliance Advice Letter.
  • Ask you to provide some more information to us.
  • Investigate.
  • Conciliate.
  • Let you know why we won’t take action.  

One person complaining on behalf of many

The Privacy Act lets one person make a complaint on behalf of many (as a class) when lots of people are affected by the same privacy breach. When this happens, the Privacy Commissioner can begin an investigation themselves.

Our privacy statement

Our privacy statement sets out how we collect, manage and use your personal information when you lodge a complaint with us. Read our privacy statement.

Back to top