What are the privacy principles?

The Privacy Act has 13 information privacy principles that deal with how personal information is treated. The principles cover the collection, storage, use and disclosure of personal information, and give people the right to access and correct their information.

Industry specific Codes of Practice may be issued under the Act that modify the privacy principles to deal with specific types of information in a way that fits well with the particular industry. The privacy principles (including those modified under any Code of Practice) provide a framework for organisations, businesses and agencies to manage their personal information handling practices.

Principle 1, principle 2, principle 3 and principle 4 govern the collection of personal information. This includes why personal information may be collected, where it may be collected from, what to tell an individual and how it is collected.

Principle 5 governs the way personal information is stored. It is designed to protect personal information held by an organisation, business or agency from unauthorised use or disclosure.

Principle 6 gives individuals the right to access information held about them by an organisation, business or agency.

Principle 7 gives individuals the right to correct information held about them by an organisation, business or agency.

Principle 8 and principle 9, principle 10, principle 11 and principle 12 place restrictions on how organisations, businesses and agencies can use or disclose personal information. These include ensuring information is accurate and up-to-date, that it isn't improperly disclosed, and that proper protections are in place when sending information overseas.

Principle 13 governs how unique identifiers - such as IRD numbers, bank client numbers, driver's licence and passport numbers - can be used.

Read our guidance to help organisations comply with the Privacy Act and its principles.

Updated October 2025