What can and can’t you (OPC) share with me?

Our staff at the Office of the Privacy Commissioner are limited in the information we can share with you about complaints or notifiable privacy breaches.

Section 206 of the Privacy Act(external link) says that OPC staff are required to maintain secrecy in respect of all matters that come to our knowledge in the exercise of our duties and responsibilities. Our secrecy obligations mean that in general we do not release information we have received from an individual or agency to:

• the agency or individual concerned
• other agencies or individuals
• the media.

This allows both agencies and individuals to provide information to us and be confident that it will not be passed on.

When we use our powers to demand information, which an agency has withheld from an IPP 6 request, we cannot share that information with the person who made the IPP 6 request. If you have been affected by a privacy breach and want more information about the agency’s response to the breach, you should ask the agency itself.

The Privacy Commissioner can only waive the requirement for secrecy in certain situations. We will consider whether these circumstances exist in response to a request for information.

Find out more about requesting information from OPC.(external link)

Note that our correspondence with an agency during an investigation cannot be requested under the Privacy Act or the OIA.

Updated November 2025