Privacy Act 2020, s 22, information privacy principle 6 

If a government agency, business or other organisation holds information about you, you have the right to:

• get them to confirm whether or not they hold the information, and
• have access to that information.

However, there are certain situations where the organisation can refuse to give you access to the information (see: “When can my request be refused?” below).

If you are given access to the information, you should also be told of your right to ask for the information to be corrected (see: “How can I correct information held about me when it’s wrong?” below).

Requests for access to your personal information can be made verbally or in writing. Although your right to see the information is given by the Privacy Act, you don’t have to specifically mention the Privacy Act when you ask for the information.

Note: The Privacy Act uses the term “personal information” as a key term in this area. Personal Information doesn’t necessarily mean information that’s particularly private or sensitive – it means information that’s about an identifiable individual person.

Privacy Act 2020, s 44 

Whoever holds the information has to respond to your request as soon as practical, and not later than 20 working days after receiving it.

Privacy Act 2020, ss 66-67

The rules are different for public and private organisations:

• Public-sector agencies like government departments can’t charge for giving people access to their information unless they have permission from the Privacy Commissioner to charge a fee. The Privacy Commissioner will only give this permission if the agency would be commercially disadvantaged compared with a private-sector competitor if they had to provide the information free of charge.
• Private-sector organisations (like most businesses) can require you to pay a reasonable charge. If you think the amount is unreasonable, you can complain to the Privacy Commissioner (see: “Complaining about a breach of your privacy”).

Privacy Act 2020, ss 39–45 

If the organisation decides to withhold some or all of the information from you, they have to tell you of that decision and the reasons for it. If you’re unhappy with the decision, you can complain to the Privacy Commissioner (see: “Complaining about a breach of your privacy”).

Usually, the organisation must make the information available in the way that you prefer – such as by giving you a written copy. However, the organisation might sometimes be able to justify giving access in a different way – for example, getting you to come in and look at the information if you’ve requested access to a particularly large amount of information.

Privacy Act 2020, ss 46, 49–53

An organisation can refuse your request to have access to your own information, but only if it’s for a reason in the Privacy Act. These reasons include that giving you the information would:

• pose a risk to New Zealand’s security or defence,
• undermine the enforcement of the law,
• endanger the safety of any individual,
• involve the unjustified disclosure of information about someone else,
• be harmful to any person’s physical or mental health (based on discussions with the person’s doctor),
• not be in your interests (but only if you’re under 16),
• breach legal professional privilege (that is, the information was communicated between a lawyer and client, or the information was obtained for court proceedings), or
• fall within the exemption for “evaluative” material – for example, information that one of your referees for a job application has given the prospective employer. In this case, the employer would be justified in refusing to tell you what the referee said.

Privacy Act 2020, ss 22, information privacy principle 7, 59-65

If an organisation holds information about you and you think the information is wrong, you’re entitled to ask them to correct it.

The organisation doesn’t have to change the information if they think it’s correct, but they’ll have to tell you that this is their decision. In that case, you have the right to get them to attach a statement to the original information that will set out:

• the correction you requested, and
• that the organisation decided not to correct the information.

For example, if the organisation that has your information is a mental health service and you disagree with a particular diagnosis that’s in your file, you can get them to attach a statement from you saying what your disagreement is. This way, your statement should always be read with the original information that you disagree with.