Tūhono│Connect
If you have serious concerns about your own agency, you may be covered by the Protected Disclosures (Protection of Whistleblowers) Act 2022 (the PDA). The PDA covers concerns raised to OPC about serious wrongdoing. It applies to privacy concerns about serious risks and criminal offences.
For more information, refer to our checklist for disclosures (opens to PDF, 262KB).
The PDA offers protections for disclosing serious wrongdoing. It explains the procedures to be followed when making a disclosure, and the protections available to those who make a disclosure.
What disclosures can OPC receive under the PDA?
If you think your agency has engaged in serious wrongdoing then OPC is the best authority to receive your concerns about the privacy of individuals or security of personal information. Activities that may be considered serious wrongdoing could include:
- The organisation unlawfully destroying the personal information it holds.
- Systemic organisational privacy issues that create serious risks to a significant number of people.
- An organisation failing to notify OPC of a notifiable privacy breach.
Our protected disclosure checklist (opens to PDF, 262KB) will help you if you’re thinking about making a protected disclosure to OPC.
To make a disclosure about serious privacy wrongdoing, email legal@privacy.org.nz.
OPC is not your only option - you can also make a protected disclosure to your own organisation or to another appropriate authority. If you need help deciding who to make a protected disclosure to, you can contact the Ombudsman for advice.
What protections does the PDA provide?
If you’ve made a good faith disclosure, OPC (or another receiver of your protected disclosure) must do their best to keep your identity confidential. That’s unless it’s essential to identify you for one of the reasons in section 17 of the PDA. We will consult you first if we think we need to share your identity. In some situations, for example, a person’s life is at risk and it is not practical to do so, we may not be able to consult with you.
If you’re concerned your privacy has been breached in relation to a protected disclosure, please make a complaint to the Privacy Commissioner.
Your employer must not retaliate or treat your less favourably because you have made a protected disclosure. OPC can address concerns about breach of your privacy if you make a protected disclosure, but we cannot address any concerns about retaliation or treatment by your employer. You can find information about PDA protections in this Ombudsman guidance (opens to PDF, 369KB).
What happens when I make a protected disclosure to OPC?
Within 20 working days of your disclosure to OPC, we will:
- Acknowledge receipt of your disclosure. We may need to contact you for information to clarify your concerns or ask if you have made the disclosure to anyone else.
- Respond to your disclosure by informing you of what we will do. We may:
a. Investigate the disclosure.
b. Refer the disclosure elsewhere — to an appropriate authority, or back to your organisation (after consulting with you).
c. Take no action.
If it’s not possible to do so within 20 working days, we will inform you of the expected timeframe and keep you updated.
Where else can I go?
If we’re not the right agency to receive your disclosure (or part of your disclosure), we can refer it to another agency under the Protected Disclosures Act. We will consult you about this first.
If you would like more information about protected disclosures:
Privacy complaint
If you want to make a privacy complaint about an organisation’s action that has affected you, or if you are representing individuals then you can make a complaint to the Privacy Commissioner.
