How can the Privacy Commissioner help me?

1 17 1 17
Last updated: January 30, 2025

When can the Privacy Commissioner help me?

The Privacy Commissioner can help if an organisation will not recognise your rights under the Privacy Act.

Under the Privacy Act you have a right to request your personal information (including personal information in records about you) held by organisations. 

Organisations include government agencies, small and large businesses, schools, charities, and community groups. The Privacy Act does not usually cover domestic situations. Domestic situations are situations that involve your family or other personal relationships. 

Personal information includes any information about you and information that could identify you.

The Privacy Act does not usually cover domestic situations. Domestic situations are situations that involve your family or other personal relationships. 

The Privacy Act sets rules which organisations must follow, so that: 

  • you know when and why an organisation is collecting information about you
  • your information is used and shared appropriately
  • your information is kept safe and secure
  • you can access the information an organisation holds about you. 

You have a right to know what personal information an organisation holds about you, and to correct it if it is wrong 

The organisation must have a lawful reason for refusing to:

  • give you access to information about you
  • correct wrong information or
  • attach a statement of correction to a record if you have told them it is incorrect.

If they do not have a lawful reason for refusing your request, you can make a complaint to the Privacy Commissioner’s office.

How to make a complaint to the Privacy Commissioner

Generally, the Privacy Commissioner will only investigate a complaint if you have made a complaint to the organisation first.

To contact the Privacy Commissioner’s office, you can: 

The Privacy Commissioner can make decisions and issue access directions  

An access direction is a binding notice to an organisation that requires them to release your records.

The Commissioner can issue an access direction if they decide that you have the right to some, or all, of the records you requested. 

The access direction will tell the organisation: 

  • what records they must release
  • the process they need to follow
  • when they must do this by. 

You can read the Access Directions Guidelinesopen_in_new which have been issued by the Privacy Commissioner. 

If an organisation disagrees with an access direction, they have 20 working days to lodge an appeal to the Human Rights Tribunal. 

If an organisation does not do what the access direction says they must do, and they have not lodged an appeal, you can apply for an ‘enforceable access order’ from the Human Rights Review Tribunal.  

This is a way to enforce the Privacy Commissioner’s access direction. 

The Privacy Commissioner may be able to support you with this application.

Exceptions to the Privacy Act

If you request records held by a court, from a case where you were not the defendant or plaintiff, the judicial officer (usually a judge) of the court may choose to deny your request.  

  • A plaintiff is someone who makes a claim in court.
  • A defendant is someone charged with a crime or someone who is defending a claim made by a plaintiff.

If you are a survivor of abuse in care and you are requesting court records about you, the courts will generally grant you access to the documents, especially if this is to support a claim.

If you request court records from any other organisation, for example Disability Support Services, normal Privacy Act and Official Information Act (OIA) rules apply, unless there is a court order or rule preventing them from providing these records to you. 

Learn more about requesting court records.