New Zealand Data Removal Guide (2026)
New Zealand residents can ask agencies for access to and correction of personal information under the Privacy Act 2020. Suppression or deletion depends on the agency's legal duties, the source record, retention needs, and the facts.
Research status: sources last checked 2026-09-07.
This page is educational orientation, not legal advice. The legal fields below are a research snapshot; eligibility, exemptions, deadlines, penalty rules and broker routes can change. Verify the current statute and regulator guidance before relying on a right or filing a complaint.
At a glance
- Governing law
- Privacy Act 2020
- Response deadline
- Access and correction requests: generally 20 working days for the agency to decide or respond (Privacy Act 2020 ss.44, 63); limited extensions and transfer rules can apply
- Regulator
- Office of the Privacy Commissioner (OPC / Te Mana Mฤtฤpono Matatapu)
- Private right of action
- Potential: an aggrieved individual may commence Human Rights Review Tribunal proceedings after the applicable Office of the Privacy Commissioner complaint or conciliation process and section 98 notice, generally within 6 months of closure, subject to statutory conditions and exceptions
Privacy Act 2020
The Privacy Act 2020 applies to New Zealand agencies through 13 Information Privacy Principles (IPPs). The Office of the Privacy Commissioner (OPC) handles complaints and can use statutory investigation and compliance-notice powers; the Act does not create a universal right to delete every record.
What rights do New Zealand residents have?
- โRight to know why personal information is being collected (IPP 2 & IPP 3)
- โRight to access personal information held by any agency (IPP 6)
- โRight to request correction of personal information (IPP 7)
- โRight to have a statement of correction attached if the agency refuses to amend data (IPP 7(2))
- โRight to limits on data retention (IPP 9)
- โRight to limits on disclosure to third parties (IPP 11)
- โRight to lodge a complaint with the Privacy Commissioner
Who holds your data in New Zealand?
A New Zealand removal request may involve printed electoral rolls, Companies Office and business records, property or other public records, telephone directories, credit-reporting agencies, marketing providers, B2B platforms, or international services. Each source and provider can have different publication, access, correction, suppression, retention, and eligibility rules.
Public-record sources brokers scrape
- Printed electoral rolls and the Electoral Commission's confidential unpublished-roll route
- Companies Office and other business or public records with source-specific access rules
- Credit-reporting, marketing, and B2B providers with provider-specific request routes
- Telephone directories, property records, and other independent source records
How to remove your data in New Zealand
- 1Apply to the Electoral Commission for the Unpublished Electoral Roll only when public listing could threaten your personal safety or that of your family. Supporting information may be required, and the unpublished-roll process affects how you vote and receive communications.
- 2Ask each telephone-directory or telecom provider about its current listing, ex-directory, or suppression process; changing one provider does not remove an independent source record.
- 3Send IPP 6 access and IPP 7 correction requests to the current agency or privacy officer for credit, marketing, B2B, or other provider records. Ask separately whether suppression or deletion is lawful and available; the agency generally has 20 working days to decide or respond, subject to statutory qualifications.
- 4If the agency does not respond or gives an inadequate response, keep the request, response, and follow-up evidence, contact the agency first where required, then use the OPC complaint self-assessment and current complaint route. The OPC or HRRT process does not guarantee removal from every source, and the OPC's own complaint page currently notes that the wait for an investigator can run up to twelve months given demand, so a complaint is not a fast alternative to the direct request.
Generate requests in under 60 seconds
Generate requests for 1,034 US/global broker workflows for $9
What if a company ignores your request?
Consider the Office of the Privacy Commissioner (OPC / Te Mana Mฤtฤpono Matatapu) information or complaint route above if the controller does not respond or the response is unsatisfactory. This guide records the following penalty orientation: Specified Privacy Act offences can carry a fine of up to NZD $10,000 on conviction; separate compliance-notice and Human Rights Review Tribunal remedies depend on the provision and facts. The private-action note is: Potential: an aggrieved individual may commence Human Rights Review Tribunal proceedings after the applicable Office of the Privacy Commissioner complaint or conciliation process and section 98 notice, generally within 6 months of closure, subject to statutory conditions and exceptions. Neither field is an individual award or a promise of enforcement.
Open the Office of the Privacy Commissioner (OPC / Te Mana Mฤtฤpono Matatapu) information or complaint route โFAQ: New Zealand data removal
How long does an agency have to respond under the NZ Privacy Act 2020?+
For an IPP 6 access request, Section 44 generally requires the agency to respond as soon as reasonably practicable and no later than 20 working days after receipt, unless a transfer or other statutory rule applies. Section 63 sets a comparable 20-working-day decision period for an IPP 7 correction request, with limited extensions available under Section 65.
How can I keep my address off the New Zealand public electoral roll?+
You can apply for the Unpublished Electoral Roll through the Electoral Commission if having your name and address on the publicly available roll could threaten your personal safety or that of your family. This is a safety-based confidentiality process, not a general deletion option, and it can require supporting information and a special-vote process.