• Home /
• Resources and learning /
• A - Z guidance topics /
• Children and young people’s privacy /
• Children's Privacy Guidance for the Education Sector /
• Chapter 14: Managing privacy complaints

Resources and learning

It is important to have a documented process for handling privacy complaints.

On this page:

• Have a privacy complaints process
• Responding to privacy complaints
• What happens when the Privacy Commissioner receives a complaint?
• Privacy complaints template
  
  

Download a PDF of the guidance on this page (PDF, 306KB).

Managing privacy complaints well can prevent a small problem becoming bigger and reduce the potential of harm (or further harm) being caused to the learner affected.

Complaints can be an indicator of problematic privacy practices or be made as result of a privacy breach. A privacy complaint provides an opportunity to review your privacy policy, processes and practices and make improvements where necessary.

Have a privacy complaints process

You should have formal privacy complaints process that people can access when they have a privacy concern. This can be part of a broader complaints process or be a standalone process for privacy complaints. 

An effective privacy complaints process will:

• enable quick resolution
• promote good decision making 
• identify and enable timely and effective responses to privacy breaches
• build and maintain good relationships.
  
  

Your complaints process should be user friendly, and enable complainants to be heard, understood, and respected, and maintain confidentiality of any information provided. Learners (or their parent’s where appropriate) should be able to make a complaint about how their personal information has been collected, used or shared if they choose to so your complaint process should enable them to do so.

At a minimum, your privacy complaint process should:

• be fit for purpose for your organisation
• be easily accessible to staff, learners, parents and the broader public e.g. published on your website, accessible through parent portals
• have clear processes for both staff and the complainants to follow
• provide different ways for making the complaint e.g. online form, email, phone number
• be clear on who will be managing the complaint process and the process for escalation
• provide timeframes for responding to complaints
• provide steps a complainant can take if they are not satisfied with the outcome.
  
  

Leaders and managers should receive regular privacy complaint and outcome reports. This information can help your leaders and managers identify privacy process and practice improvements.

Read more about setting up your privacy function in Chapter 3: Privacy is everyone's responsibility.

Read more about responding to privacy incidents in Chapter 15: Privacy incidents.

Review your complaints process

Your privacy complaints process should be reviewed regularly to ensure it remains fit for purpose. This is an activity you can add to your privacy officer’s workplan.

Back to top.

Responding to privacy complaints

How you respond to a concern, or a complaint can have a significant impact on the experience of the complainant, and the resolution of the complaint.

When responding to a privacy complaint you should take the following steps:

1. Acknowledge the complaint.
2. Listen to the complainant.
3. Investigate the issues raised by the complainant.
4. Try to resolve the issues.
5. Rebuild the relationship.
   
   

Read more about responding to privacy complaints in our step-by-step guide.

Consider Tikanga

Incorporating tikanga into your complaints management process can be a powerful tool to help manage privacy concerns and complaints in a mana enhancing way.

A tikanga based approach to managing privacy concerns and complaints can help encourage parties to focus on communication and interaction during the process rather than just the outcome of the process.

Tikanga that can be readily incorporated into the way you manage complaints include:

• Kanohi ki te kanohi – where possible meet with the complaint in person.
• Whanaungatanga – spend some time getting to know each other before you get into discussions about the complainant’s concerns.
• Manakitanga – encourage people to share their story, actively listen and build respectful relationships.

Additional guidance

Read more about how to respond to complaints in Poupou Matatapu.

The Ministry of Education also has guidance for schools and ECE services about managing general complaints:

• Schools: Dealing with complaints - Educational Leaders.
• ECE Services: Guidance for developing a complaints policy.

Back to top.

What happens when the Privacy Commissioner receives a complaint?

A complainant (including a learner or their representative) must have attempted to resolve their issues with you before they can make a complaint to the Privacy Commissioner.

When a complaint is made to the Privacy Commissioner, the Commissioner will decide on whether to investigate the complaint and work to resolve the complaint in a way that is acceptable to both parties. The purpose of the investigation is to determine which principles of the Privacy Act may have been breached and how.

The Commissioner cannot investigate every complaint. The Commissioner is generally obliged to review an agency’s response to access and correction requests but will triage other complaints from individuals to focus on cases where harm has occurred as a result of a breach of an Information Privacy Principle (IPP).

Where a decision to investigate is made, the Privacy Commissioner will contact both you and the complainant and advise that an investigation is commencing.

Investigations are conducted by talking to the parties concerned in person, by phone, email or in writing. You may also be asked to provide documents and information relevant to the investigation, if this is the case you must provide the documents and information requested.

Additional Guidance

For more information about how the Privacy Commissioner manages privacy complaints see:

• Responding to requests and complaints well.
• OPC Complaint Handling Policy.
• OPC Decision Guide.

Back to top.

Privacy complaints template: Information for learners, parents, and the community

This template sets out the key information people should know about your complaints process. 

You can amend the content of the template to fit your internal complaints processes and procedures. The template can also be amended by using age-appropriate language and methods for learners of different ages and abilities to raise their concerns.

Download a PDF version of this template (PDF, KB).