Privacy Act 2020, Compliance Notices and Offences
Privacy Act 2020 (NZ), No 31, ss. 123, 126, 130, 212
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 December 2020.
An enforcement supervision rule binding public and private bodies.
As of 6 September 2026.
What it requires
- Comply with a compliance notice issued by the Commissioner to remedy a breach of the Act, an interference with privacy, or a breach of a code of practice, or face enforcement proceedings before the Human Rights Review Tribunal.
- Do not obstruct, hinder, or resist the Commissioner, make a false or misleading statement, falsely claim authority under the Act, impersonate an individual to obtain or alter their personal information, or destroy a document to defeat a request; each is an offence carrying a fine of up to $10,000.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Under s. 212(1) and (2), a person who obstructs the Commissioner, fails to comply with a lawful requirement, makes a false or misleading statement, falsely claims authority under the Act, impersonates an individual, or destroys a document to defeat an access request commits an offence and is liable on conviction to a fine not exceeding $10,000 for each subsection.
Penalty structure
Fine on conviction under s. 212(1) or (2) for each listed offence (obstruction, false statement, false claim of authority, impersonation, or destruction of a document to defeat an access request).
- Rule
- Fixed only
- As of
- 6 September 2026
- Currency
- NZD
- Fixed cap
- 10,000
Who enforces it
Enforcement body
Office of the Privacy Commissioner; Human Rights Review Tribunal
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Privacy Commissioner may issue a compliance notice requiring an agency to remedy a breach of the Act, an interference with privacy, or a breach of a code of practice, and an agency issued with one must take steps to comply as soon as practicable; if the agency has not remedied the breach after the appeal period, the Commissioner may take enforcement proceedings in the Human Rights Review Tribunal.
Separately, section 212 makes it an offence, on conviction carrying a fine of up to $10,000, to obstruct or mislead the Commissioner, make a false statement, falsely claim authority under the Act, impersonate an individual to obtain or alter their personal information, or destroy a document to defeat an access request.
When LexLint raises it
crawls_webtrains_models
Read the law
official consolidated Act text, New Zealand Legislation