TL;DR: Under the Privacy Act 2020, you can ask any organisation for the personal information it holds about you. It must respond as soon as reasonably practicable and no later than 20 working days after receiving your request. It can extend only with reasons, told within the original timeframe. Refusals are allowed only on specific grounds, and you can complain to the Privacy Commissioner if you’re unhappy. Here’s how to do it.
Your right
From Sprintlaw’s guide to access requests:
| Rule | Detail |
|---|---|
| Deadline | No later than 20 working days (excluding weekends and public holidays) |
| Extensions | Must be reasonable, given within the original 20 days, with reasons and your right to complain |
| Identity checks | Must be proportionate; stronger for sensitive info |
| Refusals | Only on set grounds, e.g. revealing someone else’s info, prejudicing the law, trade secrets, legal privilege, serious threat to safety. Redaction is an option |
| Complaints | You must be told you can complain to the Privacy Commissioner |
How to make the request
- Find the privacy officer (usually in the privacy policy).
- Send it in writing so you have a timestamp.
- Keep it simple. Something like:
"Under the Privacy Act 2020, I request access to all personal information you hold about me, including where you got it from and who you’ve shared it with. My details: [name, email, phone, account number]. Please respond within 20 working days."
- Provide ID if they ask (proportionate checks only).
- Diary the 20-working-day deadline.
What to do with the results
- Wrong information? Ask for it to be corrected.
- Surprised by who they shared it with? Ask why.
- Got nothing back? Complain to the Privacy Commissioner (how). Access complaints don’t need proof of harm.
Good places to start
- Credit agencies (Centrix, Equifax, Experian): see also free credit reports.
- Your bank and telco.
- Health providers have specific rules: see accessing health records.
- Companies that told you about a breach: ask exactly what of yours was taken.
What the Privacy Commissioner adds
The Office of the Privacy Commissioner’s ask for your information page fills in the practical rules:
| Question | OPC answer |
|---|---|
| How do I ask? | By email, letter, phone or in person, or use the OPC’s free AboutMe tool |
| Will it cost? | In most cases you shouldn’t be charged to access or correct your information |
| Deadline? | 20 working days. They can acknowledge first and send later, but without undue delay |
| Can they extend? | Only in limited cases, and they must explain why and tell you when |
| Urgent? | You can ask; explain why. They can refuse urgency but must give reasons |
| Wrong organisation? | They can transfer your request, but must tell you within 10 working days |
If you get nowhere, go to the organisation’s privacy officer first, then the Privacy Commissioner. Be patient: the OPC warns complaint investigations can take more than 12 months to be assigned (how to complain).
Not sure who holds your data?
A free exposure check lists the breaches your email appears in, which is a handy list of who to ask. The Privacy Commissioner also wants a right to erasure added to the Act (more).
Frequently Asked Questions
Is there a free tool to make a privacy request in NZ?
Yes. The Privacy Commissioner’s AboutMe tool helps you request your information. You can also ask by email, letter, phone or in person.
How long does a NZ organisation have to answer a privacy access request?
As soon as reasonably practicable and no later than 20 working days.
Can an organisation extend the deadline?
Yes, if the extension is reasonable and communicated within the original timeframe with reasons and information about your right to complain.
Can they refuse my request?
Only on specific grounds, such as revealing someone else’s information or a serious safety threat. They may redact instead.
Where do I complain if they don’t respond?
To the Office of the Privacy Commissioner.
Sources
- Office of the Privacy Commissioner: Ask for your information
- Sprintlaw: Responding to personal information access requests in NZ