Home
Acts
Privacy Act 2020
Notifiable privacy breaches and compliance notices
Notifiable privacy breaches
121: Knowledge of officers, employees, agents, and members of agencies to be treated as knowledge of employers, principal agencies, and agencies

Part 1:
Preliminary provisions

Preliminary matters

3Purpose of this Act 4Application of this Act 5Transitional, savings, and related provisions 6Act binds the Crown

Interpretation and related matters

7Interpretation 8Meaning of New Zealand agency 9Meaning of overseas agency 10Personal information held by agency if held by officer, employee, or member of agency 11Personal information treated as being held by another agency in certain circumstances 12Actions of, and disclosure of information to, staff of agency, etc

Part 2:
Privacy Commissioner

Appointment of Privacy Commissioner

13Privacy Commissioner 14Deputy Privacy Commissioner 15Holding of other offices 16Superannuation or retiring allowances

Functions of Privacy Commissioner

17Functions of Commissioner 18Other functions of Commissioner 19Responsible Minister must present copy of report on operation of Act to House of Representatives 20Duty to act independently 21Commissioner to have regard to certain matters

Part 3:
Information privacy principles and codes of practice

Information privacy principles

22Information privacy principles 23Application of IPPs in relation to information held overseas 24Relationships between IPPs and other New Zealand law 25IPPs 1 to 4 do not apply to personal information collected before 1 July 1993 26Restricted application of IPP 13 to unique identifiers assigned before 1 July 1993 27Restricted application of IPPs to personal information collected or held for personal or domestic affairs 28IPPs 2, 3, and 4(b) do not apply to personal information collected by intelligence and security agencies 29IPPs 6 and 7 do not apply to certain information 30Commissioner may authorise collection, use, storage, or disclosure of personal information otherwise in breach of IPP 2 or IPPs 9 to 12 31Enforceability of IPPs

Codes of practice

32Codes of practice in relation to IPPs 33Issue of code of practice 34Urgent issue of code of practice 35Commencement of code 36Application of Legislation Act 2019 to codes 37Amendment and revocation of codes of practice 38Effect of codes of practice

Part 4:
Access to and correction of personal information

Access to personal information

Correction of personal information

58Interpretation 59Individuals may make correction requests 60Urgency 61Assistance 62Transfer of correction request 63Decision on request to correct personal information 64Decision on request to attach statement of correction 65Extension of time limits

Charges

66Charges 67Commissioner may authorise public sector agency to impose charge

Part 5:
Complaints, investigations, and proceedings

68Interpretation 69Interference with privacy of individual

Complaints

70Complaints 71Who may make complaint 72Form of complaint 73Procedure on receipt of complaint 74Commissioner may decide not to investigate complaint 75Referral of complaint to another person 76Referral of complaint to overseas privacy enforcement authority 77Exploring possibility of settlement and assurance without investigating complaint 78Referral of complaint to Director without conducting investigation

Investigations by Commissioner

79Application of this subpart 80Commencing investigation 81Conducting investigation 82Commissioner may regulate own procedure 83Exploring possibility of settlement and assurance during investigation 84Referral of complaint to Director without completing investigation 85Compulsory conferences of parties to complaint 86Power to summon persons 87Power to require information and documents 88Disclosure of information may be required despite obligation of secrecy 89Protection and privileges of persons required to provide information, etc 90Disclosed information privileged 91Procedure after completion of investigation relating to access to personal information 92Access direction 93Procedure after completion of investigation relating to charging 94Procedure after completion of other investigations 95Special procedure relating to intelligence and security agency 96Commissioner to report breach of duty or misconduct

Proceedings before Human Rights Review Tribunal

Part 6:
Notifiable privacy breaches and compliance notices

Notifiable privacy breaches

112Interpretation 113Assessment of likelihood of serious harm being caused by privacy breach 114Agency to notify Commissioner of notifiable privacy breach 115Agency to notify affected individual or give public notice of notifiable privacy breach 116Exceptions to or delay in complying with requirement to notify affected individuals or give public notice of notifiable privacy breach 117Requirements for notification 118Offence to fail to notify Commissioner 119Section 211 does not apply to processes and proceedings relating to failure to notify notifiable privacy breach 120Liability for actions of officers, employees, agents, and members of agencies 121Knowledge of officers, employees, agents, and members of agencies to be treated as knowledge of employers, principal agencies, and agencies 122Publication of identity of agencies in certain circumstances

Compliance notices

123Compliance notices 124Issuing compliance notice 125Form of compliance notice 126Agency response to compliance notice 127Commissioner may vary or cancel compliance notice 128Commissioner’s power to obtain information 129Publication of details of compliance notice

Proceedings

130Enforcement of compliance notice 131Appeal against compliance notice or Commissioner’s decision to vary or cancel notice 132Interim order suspending compliance notice pending appeal 133Remedies, costs, and enforcement 134Application of Human Rights Act 1993 135Commissioner may be represented in proceedings

Part 7:
Sharing, accessing, and matching personal information

Information sharing

136Purpose of this subpart 137Relationship between subpart 1 and other law relating to information disclosure 138Interpretation 139Information sharing between agencies 140Information sharing within agencies 141Parties to information sharing agreement 142Agreement may apply to classes of agencies 143Lead agency 144Form and content of information sharing agreement 145Governor-General may approve information sharing agreement by Order in Council 146Requirements for Order in Council 147Further provisions about Order in Council 148Status of Order in Council 149Matters to which relevant Minister must have regard before recommending Order in Council 150Consultation on proposed information sharing agreement 151Commissioner may prepare and publish report on approved information sharing agreement 152Requirement to give notice of adverse action 153When requirement to give notice of adverse action applies 154Responsibilities of lead agency 155Report of lead agency 156Commissioner may specify frequency of reporting by lead agency 157Amendment of approved information sharing agreement 158Review of operation of approved information sharing agreement 159Report on findings of review 160Relevant Minister must present copy of report under section 159(1) and report setting out Government's response to House of Representatives 161Power to amend Schedule 2 by Order in Council

Identity information

162Purpose of this subpart 163Relationship between this subpart and other law relating to information disclosure 164Interpretation 165Access by agencies to identity information 166Manner and form of access 167Annual reporting requirement 168Power to amend Schedule 3 by Order in Council

Law enforcement information

169Purpose of this subpart 170Relationship between this subpart and other law relating to information disclosure 171Interpretation 172Access by accessing agencies to law enforcement information 173Power to amend Schedule 4 by Order in Council

Authorised information matching programmes

174Purpose of this subpart 175Application of this subpart 176Relationship between this subpart and other law relating to information disclosure 177Interpretation 178Information matching agreements 179Use of results of authorised information matching programme 180Extension of time limit 181Notice of adverse action proposed 182Reporting requirements 183Reports on authorised information matching programmes 184Reports on information matching provisions 185Responsible Minister must present copy of report under section 184 and report setting out Government’s response to House of Representatives 186Avoidance of controls on information matching through use of exceptions to information privacy principles 187Avoidance of controls on information matching through use of official information statutes 188Power to amend Schedule 5 by Order in Council 189Power to amend Schedule 6 by Order in Council 190Amendments to other enactments related to this subpart 191Repeal of section 190 and Schedule 7

Part 8:
Prohibiting onward transfer of personal information received in New Zealand from overseas

192Interpretation 193Prohibition on transfer of personal information outside New Zealand 194Commissioner's power to obtain information 195Transfer prohibition notice 196Commissioner may vary or cancel transfer prohibition notice 197Offence in relation to transfer prohibition notice 198Appeals against transfer prohibition notice 199Application of Human Rights Act 1993 200Power to amend Schedule 8 by Order in Council

Part 9:
Miscellaneous provisions

General

201Privacy officers 201AResponsibility under Parts 4 to 6 for interdepartmental executive board 202Commissioner may require agency to supply information 203Inquiries 204Powers relating to declaratory judgments 205Protection against certain actions 206Commissioner and staff to maintain secrecy 207Commissioner may share information with overseas privacy enforcement authority 208Consultation 209Exclusion of public interest immunity 210Adverse comment

Liability and offences

211Liability of employers, principals, and agencies 212Offences

Regulations

213Regulations: prescribed binding schemes 214Regulations: prescribed countries 215Other regulations

Repeal, revocation, and consequential amendments

216Repeal and revocation 217Consequential amendments 218Repeal of section 217 and Schedule 9

Schedule 1:
Transitional, savings, and related provisions

Schedule 2:
Approved information sharing agreements

Schedule 3:
Identity information

Schedule 4:
Law enforcement information

Schedule 5:
Information matching provisions

Schedule 6:
Information matching rules

Schedule 7:
Amendments to other enactments related to subpart 4 of Part 7

Schedule 8:
Basic principles of national application set out in Part Two of OECD Guidelines

Schedule 9:
Consequential amendments

Summary of changes

We haven’t prepared a plain language version of this yet

We haven’t created a plain language version of this legislation yet. We’re working through New Zealand’s laws to make them more accessible to everyone, focusing on areas that impact the most people first.

If you’d like to see this particular legislation explained in plain language, please email us at hello@ackama.com with the subject “Plain language law” and mention this page — we’ll be happy to add it to our priority list.

Request a plain language version

Part 6Notifiable privacy breaches and compliance notices
Notifiable privacy breaches

121Knowledge of officers, employees, agents, and members of agencies to be treated as knowledge of employers, principal agencies, and agencies

Subsection (2) applies to processes and proceedings under this Act relating to the obligations under section 114 or 115.
Anything relating to a notifiable privacy breach that is known by an officer, an employee, or a member of an agency is to be treated as being known by the employer or agency.
Subsection (4) applies to processes and proceedings under this Act relating to the obligations under section 114 or 115 except a proceeding under section 118.
Anything relating to a notifiable privacy breach that is known by an agent is to be treated as being known by the principal agency.
For the purposes of subsection (4), a person (A) is an agent of an agency (B) if A holds information for or on behalf of B (for example, as a representative or an agent of B, or for safe custody or processing on behalf of B).

Notes

Section 121 heading: amended, on 30 November 2022, by section 98(1) of the Statutes Amendment Act 2022 (2022 No 75).
Section 121(2): amended, on 30 November 2022, by section 98(2) of the Statutes Amendment Act 2022 (2022 No 75).
Section 121(5): inserted, on 27 November 2025, by section 127 of the Statutes Amendment Act 2025 (2025 No 74).

We haven’t prepared a plain language version of this yet

Part 6Notifiable privacy breaches and compliance noticesNotifiable privacy breaches

121Knowledge of officers, employees, agents, and members of agencies to be treated as knowledge of employers, principal agencies, and agencies

Part 6Notifiable privacy breaches and compliance notices
Notifiable privacy breaches