13 Nov 2026, 11:30

Read the full Annual Report (PDF download, 2, 985KB).

Download a copy of the Annual Report in Word format. 

Privacy is precious. Privacy breaches cause real harm to thousands of New Zealanders a year. This harm can take many forms. It could be emotional hurt arising from intimate information being made public. Or it could be a direct financial loss as the privacy breach was a part of a scam. A privacy breach might also lead to physical harm, if your location became known to the wrong people.

Three years ago, I set for my Office the purpose of making privacy a core focus for agencies. We do this not only to protect the privacy of individuals, but because we believe that privacy enables agencies to achieve their own objectives – whether that is turning a profit or providing a social service. Privacy is also an important safeguard of our free and democratic society, an important point as our country heads to the polls.

We operate in a challenging environment. The volume and complexity of privacy breaches is increasing as individuals and agencies use and share more personal information. This year provided a clear example of the situation. On the first of January, Manage My Health notified my Office that an overseas hacker had accessed the personal information of over 99,000 New Zealanders who were spread across hundreds of medical centres.

New Zealanders appreciate the privacy challenges we are facing. Our annual privacy survey of 1,300 New Zealanders again found that 82% wanted more control and choice over the collection and use of their personal information, but that only 46% felt in control of their data privacy. Three quarters of our respondents also supported strengthening the Privacy Act 2020 in a variety of different ways, including through strengthening the compliance and enforcement powers available to my Office.

I urge our companies, government agencies, councils and not-for-profits to regard privacy not as an “either/or”, but as an “and” or a “while”. You can do privacy well and make a profit. You can provide your clients with the services they need while protecting their privacy rights. You can adopt biometric and artificial intelligence technologies while respecting personal information. New Zealanders will support agencies who respect privacy: twothirds of our survey respondents state they would consider changing service providers over poor privacy and security practices.

This Annual Report provides an opportunity to reflect on the achievements of my Office this year and the progress we are making. A positive sign of progress is that our privacy surveys are indicating a small but consistent increase in New Zealanders’ awareness of their privacy right to access their personal information held by agencies. However, I must also caution that the Act needs urgent strengthening given the major privacy breaches, such as the Manage My Health breach, that we now see every year.

Like other agencies, my Office is having to rigorously prioritise how it applies its resources. The Office is currently going through a change exercise focused on reducing our expenditure, while ensuring we are configured in the best way possible to deliver on our strategic direction, purpose, and objectives. As a part of our prioritisation, we changed the way we provide our public enquiries service. We moved away from providing a bespoke public enquiries service and instead now focus on providing a
one-to-many self-help service that leverages our website content.

Above all, this Annual Report is a chance for me to acknowledge the work and achievements of my staff that are driving us towards our four objectives:

1. Work in partnership with Māori to take a te ao Māori perspective on privacy.
2. Engage and empower people and communities who are more vulnerable to serious privacy harm.
3. Set clear expectations to provide agencies with greater certainty about their responsibilities.
4. Promptly use our full range of investigation and compliance powers to hold agencies accountable for serious privacy harm.

Our achievements this year

Underpinning our achievements is a passion for protecting the privacy of New Zealanders, matched with a pragmatic and constructive approach to the opportunities and challenges that agencies are navigating. 

Just some of the highlights of our work this year were:

• Receiving and processing extremely high levels of privacy complaints, with 1,644 received from individuals and in many cases finding they had experienced harm from privacy breaches. An investigation into a large representative complaint involving more than 1,600 affected individuals was completed.
• Releasing a large amount of guidance on how agencies can protect the privacy and safety of children and young people. This was supported by the Privacy Commissioner engaging with public sector agencies around information sharing where there are concerns about the wellbeing or safety of a child or young person.
• Supporting the commencement of the new Information Privacy Principle 3A in the Act with comprehensive guidance and supporting amendments to the codes of
  practices. We also created a short video on the new principle and presented to a variety of industry bodies and forums.
• Receiving 133 requests for speeches and presentations, and our staff spoke to a diverse range of businesses, peak industry bodies, government agencies, health
  providers, churches, schools and not for profit organisations.
• Hosting the Sir Bruce Slane Memorial Lecture, in honour of New Zealand’s first Privacy Commissioner, with Justice Christian Whata (Ngāti Pikiao and Ngāti Tamateatūtahi – Kawiti of Te Arawa) speaking about the tapu of privacy and viewing privacy through a tikanga lens.
• Continuing our work with Te Ranga Tautiaki, our Māori reference panel, which provides us with an opportunity to receive expert advice on te ao Māori perspectives on our work programme.
• Receiving 2,231 privacy breach notifications, doubling last year’s volume due to the many agencies related to the Manage My Health and MediMap cybersecurity breaches. We commenced an Inquiry into the Manage My Health breach, and completed the first phase in the 2025/26 year.
• Making 14 submissions to select committees to ensure privacy is being considered in the Government’s legislative programme and petitions from New Zealanders. A major submission for us was stating our clear opposition to the Policing Amendment Bill, which authorises the New Zealand Police to record images and sounds and
  collect personal information, including for intelligence purposes, without including appropriate safeguards.
• Intervening in a Court of Appeal case considering the lawfulness of New Zealand Police using automatic number plate recognition, focusing on the privacy implications of this technology.
• Completing our website redevelopment in-house, which simplified our website structure and increased accessibility, and simplifying and improving the 650 questions in our Ask Us knowledge base. We supported these efforts through ensuring our privacy rights material is available in Easy Read, sign language, Braille, and in six new languages.
• Hosting Privacy Week 2026, where over 5,500 people watched 18 free webinars on the theme of ‘Foundations of the Future’, including topics such as AI.
• Contributing to discussions around regulatory options to incentivise the protection of personal information and strengthening compliance with good privacy practice.

Our year has been busy, but successful. I want to thank all of my staff, who have made all the above possible.

I look forward to what we will achieve over the coming year.

We focused on three key things in 2025/26

In our third year under the Statement of Intent 2023–2027 we pursued three key areas of strategic focus.