Accessing your personal information

Under the Privacy Act you can request access to personal information an organisation holds about you.

Information Privacy Principle 6 of the Privacy Act 2020 gives every person the right to access to any personal information an organisation (public or private sector) holds about them.

What can I ask for?

The Privacy Act 1993 says that you can access any personal information that an organisation holds about you. It is important to note that, apart from a few exceptions, you can only ask for information that is about you.

In some circumstances you can request information about someone else if you can show you have their permission to act on their behalf.

If you are seeking information about someone else, and you don’t have authority to act on their behalf, you will need to make an Official Information Act request. The Official Information Act requests page explains how to do this.

Will I get everything I ask for?

It is important to note that the Privacy Act only grants you the right to access your information however, it does not mean that you will be given all the information an organisation holds about you.

The Privacy Act contains several sections (27-29) which list the reasons why an organisation may withhold (or redact) some or all of your information. Listed below are some (but not all) of the reasons an organisation may withhold information:

• that the disclosure of the information would involve the unwarranted disclosure of the affairs of another individual or of a deceased individual
• that disclosure of the information may prejudice the maintenance of the law by any public sector agency
• the information requested is not readily retrievable
• the information does not exist or cannot be found
• the disclosure of the information (being information that relates to the physical or mental health of the individual who requested it) would be likely to prejudice the physical or mental health of that individual
• where releasing the information may prejudice the security or defence of NZ.

We have 20 working days after we receive your request to let you know whether or not we have granted your request. Where information is withheld or redacted, we must provide you with the reason we have done so.

In some instances if fulfilling your request means a large amount of work or will entail a large amount of information, we may come back to you and ask you to refine the request, or let you know if we need an extension so we can respond to your request in full.

Additionally, if you have asked for information which we do not hold, the Privacy Act states that we must transfer that part of the request to the appropriate agency for them to deal with.

We also need to make sure that we only provide personal information to someone who is entitled to receive it. That means before we release personal information we might ask you to prove your identity, or to show us that you do have permission to request access to information about someone else.

How much will it cost me?

As a public sector agency we cannot request payment from anyone who makes a Privacy Act request.

How do I make a request?

We have two different emails addresses depending upon the type of personal information you wish to request.

If you wish to request just your travel movements then the travel movement request page explains how to do this.

If you wish to request access to more than just your travel movements, then email privacy@customs.govt.nz with details of your request.