If you think that one of the rules in the Privacy Act has been breached, you should usually start by complaining directly to the particular government agency, business or other organisation that you’re unhappy with. Sometimes, letting that organisation know what the problem is can resolve it without having to take it further. If you complain directly to the Privacy Commissioner’s office, the Privacy Commissioner may decide not to deal with your complaint until you’ve tried to resolve the problem with the relevant organisation.

All organisations should have someone who’s been appointed as a privacy officer to deal with privacy issues. This privacy officer will usually be the best person to talk to about the problem. You can ask who the organisation’s privacy officer is, and then complain to them directly, either verbally or in writing. If the organisation doesn’t have a privacy officer, then you can talk to a manager or other senior person there.

Privacy Act 2020, s 201 

Every organisation must appoint someone to be its privacy officer. The privacy officer’s responsibilities include:

• encouraging the organisation to comply with the privacy laws
• dealing with requests made to the organisation about individuals’ information
• working with the Privacy Commissioner when they investigate complaints, and
• otherwise making sure that the privacy laws are complied with.