What does the Privacy Act apply to?

The purpose of the Privacy Act is to protect people’s right to privacy of personal information. This means it applies when personal information is collected, used, shared, or stored by an agency. It applies to both public and private sector organisations.

Agencies that are covered by the Privacy Act include:

• Government departments and agencies, such as the Police and Ministry of Social Development
• companies
• businesses, including retail stores, online shops, and supermarkets
• social clubs
• charities, societies, and community groups
• other types of organisations that use personal information.

There are some key exceptions where the Privacy Act does not apply. These include:

• An individual acting in their personal or domestic capacity. For example, when you talk about your life with friends or take photos of your family members.
• Court and tribunals (in relation to their judicial functions), including investigations in the Employment Relations Tribunal and criminal trials in the District Court.
• News media (in relations to their news gathering and news reporting functions). For example, the Privacy Act will not apply to a journalist when they are interviewing a source for a news story.
• Members of Paliament (MPs) (when acting in an official capacity).

For a full list of exceptions, see the definition of ‘agency’ in section 8 of the Privacy Act 2020(external link).

Updated October 2025