TL;DR: In its 2024/25 annual report, New Zealand’s Privacy Commissioner reported serious privacy breach notifications up 43% and privacy complaints up 21% (on a previous record year). Commissioner Michael Webster wants a right to erasure, a much stronger penalty regime, proof of privacy compliance, protections around automated decisions, and more powers. Survey: 82% of Kiwis want more control over their personal information.
The numbers
From the Privacy Commissioner’s November 2025 release:
| Measure | 2024/25 |
|---|---|
| Serious privacy breach notifications | +43% |
| Privacy complaints | +21% (on a record 2023/24) |
2025 Privacy Survey:
| Concern | Share |
|---|---|
| Protecting personal privacy is a major concern | 66% |
| Concerned about children’s privacy | 67% |
| Concerned about AI decisions using their data | 62% |
| Want more control and choice | 82% |
What the Commissioner is asking for
- A right to erasure: ask organisations to delete your personal information.
- A significantly stronger penalty regime.
- Organisations must demonstrate how they meet privacy obligations.
- Stronger protections for people affected by automated decision-making.
- Stronger powers for the Commissioner.
Webster: "The Privacy Act currently provides insufficient incentives for many organisations."
Why it matters right now
Today, the Privacy Act has no civil fines for failing to protect data; the only fines are for not notifying a breach. After the Manage My Health and MediMap incidents, the government’s cyber action plan asked the Ministry of Justice to look at civil penalties (details).
In other words: the watchdog has a loud bark. It’s asking for some teeth.
What you can do today
Even without erasure rights, you already have strong rights under the current Act:
- See what an organisation holds on you (access requests).
- Ask for corrections.
- Complain to the Privacy Commissioner (how).
- Freeze your credit if your ID leaked (credit suppression).
A free exposure check shows which breaches your email is in, a good starting list for access requests.
Frequently Asked Questions
How much did privacy breaches increase in NZ?
Serious privacy breach notifications rose 43% in 2024/25, according to the Privacy Commissioner.
Does New Zealand have a right to be forgotten?
Not yet. The Privacy Commissioner has recommended adding a right to erasure to the Privacy Act.
Can the NZ Privacy Commissioner fine companies?
Not for poor security. The Commissioner is asking for a much stronger penalty regime.
What do New Zealanders want on privacy?
82% want more control and choice over how their personal information is collected and used.