TL;DR: To complain to New Zealand’s Office of the Privacy Commissioner (OPC): (1) complain in writing to the organisation first (the OPC won’t accept your complaint otherwise); (2) check the OPC is the right body; (3) gather evidence; (4) fill in the online self-assessment and complaint form. Investigations can take up to 12 months to start. The OPC can’t fine organisations or order them to pay you, but it can investigate, conciliate and issue directions. Class complaints are possible.
Step 1: Complain to the organisation
The OPC says it "won’t accept a complaint to the Privacy Commissioner if you haven’t done step one." Write to the organisation, explain the issue, keep a copy.
Step 2: Make sure the OPC is the right place
| Issue | Who handles it |
|---|---|
| Employment | Employment Relations Authority or Labour Inspectorate |
| Health care | Health and Disability Commissioner |
| Government agencies (some issues) | Ombudsman |
| Tenancy | Tenancy Disputes Tribunal |
| Harmful online content | Netsafe |
| Mishandling of your personal information | Privacy Commissioner |
Step 3: Gather evidence
- Proof you tried to resolve it (your complaint and their response)
- All correspondence, with dates and sender/recipient (PDFs of emails recommended)
- How you were affected
- What you want them to do
- A signed representative authority form if someone else (not a lawyer) acts for you
The online form can’t be saved halfway, so have everything ready. It’s not a form you want to do twice.
Step 4: Lodge online
Complete the self-assessment and complaint form and agree to the OPC’s Service Charter and Unreasonable Conduct Policy.
What happens next
The OPC may: make a preliminary enquiry, send a Compliance Advice Letter, ask for more information, investigate, conciliate, or explain why it won’t act. Investigations can involve a wait of up to 12 months due to demand.
Good to know: most complaints need evidence of harm, but access and correction complaints don’t.
What the OPC can’t do
- Issue fines
- Order the organisation to pay you money
- Force anyone to accept a settlement or its findings
That’s why the Commissioner is asking Parliament for stronger powers (more).
Class complaints
One person can complain on behalf of a group affected by the same breach. Useful after big incidents like Manage My Health.
Complaints are at record levels
The Privacy Commissioner said in November 2025 that privacy complaints in 2024/25 were up 21% on the year before, itself a record. Organisations also notified 43% more serious privacy breaches.
Commissioner Michael Webster said the Privacy Act gives "insufficient incentives for many organisations" to get the basics right, and asked for changes including:
- a right to erasure (asking an agency to delete your information);
- a significantly stronger penalty regime;
- requirements for agencies to show how they meet privacy rules;
- stronger protection around automated decisions.
None of that is law yet. For now, the OPC still can’t fine organisations, which is why a clear written complaint and good evidence matter so much.
Before you complain
Make an access request to see exactly what they hold. A free exposure check shows which breaches your email is in.
Frequently Asked Questions
Are privacy complaints rising in New Zealand?
Yes. The Privacy Commissioner said complaints in 2024/25 were up 21% on the previous record year, and serious breach notifications rose 43%.
Do I have to complain to the organisation before the Privacy Commissioner?
Yes. The OPC won’t accept a complaint unless you’ve first complained to the agency.
How long does a privacy complaint take in NZ?
If an investigation is needed, the wait for an investigator can be up to 12 months.
Can the Privacy Commissioner fine a company?
No. It can’t issue fines or order payment, but it can investigate, conciliate and issue directions after an investigation.
Can I make a complaint for a group of people?
Yes. One person can make a class complaint for a group affected by the same breach.
Sources
- Privacy Commissioner: New Zealand needs Privacy Act modernisation (Nov 2025)
- Office of the Privacy Commissioner: How to complain