- The law
- Privacy Act 2020, information privacy principles 6 and 7, sections 44, 48, 63 and 65
- Who enforces it
- Office of the Privacy Commissioner
- Penalties
- Fines of up to NZ$10,000 for some offences, and the Human Rights Review Tribunal can award damages
What it means for your email
- A subscriber can ask to confirm whether you hold personal information about them, to have access to it (principle 6), and to have it corrected (principle 7).
- Section 44 says you must respond as soon as reasonably practicable, and no later than 20 working days after the day you receive the request: whether you hold the information and whether you'll give access.
- Section 48 lets you extend the time limit for a reasonable period where there's a lot of information, consultation is needed, or the request is complex. Tell the person within the 20 working days, with how long and why, and that they can complain to the Privacy Commissioner.
- Correction requests have the same 20 working day limit (section 63) and can be extended in the same way (section 65).
Do
- Log each request with a reference and its deadline (counting working days) when it arrives.
- Find the person's information in your email platform and anywhere else it's kept.
- Correct information when asked, or note that a correction was requested.
- Keep a record of what you did.
Don't
- Don't let 20 working days pass without a decision or a notice of extension.
- Don't put the person's details in tools that don't need them.
Good to know
- Unsubscribing from commercial emails is a separate rule under the Unsolicited Electronic Messages Act: act on it within 5 working days.
Sources
- Privacy Act 2020 (New Zealand Legislation)
- Principle 6: Access to personal information (Office of the Privacy Commissioner)
Researched by Mailfois · 2026/27 edition · checked 20 October 2026
Not legal advice. This is a plain-English summary. Check the sources for anything specific, or take professional advice. Spotted something out of date? Email [email protected] and we'll credit you if you'd like.