Office of the Privacy Commissioner | New on the website
Most recently edited pages
Displaying 1 - 10 of 30
Final report into Manage My Health inquiry a wake-up call for agencies
Privacy Commissioner Michael Webster has today released his second and final report into the Manage My Health (MMH) cybersecurity breach of December 2025.
Manage My Health phase two report
This page has the Executive Summary of the Manage My Health phase two report.
Manage My Health Inquiry
The second and final phase of the Manage My Health inquiry is now complete.
PBN/3886 [2026] NZPrivCmr3 - OPC can make targeted adverse comments in response to privacy matters
An organisation, which operates in New Zealand but has a parent company overseas, may not have been meeting its obligations...
PBN4406 [2026] NZPrivCmr 2 - Legal practice didn’t recognise that a cyber security incident was also a notifiable privacy breach
In November 2025 a legal practice notified us of a privacy breach. The incident concerned unauthorised access to an email account...
How retailers can protect personal information
Retailers have obligations to protect personal information under the Privacy Act 2020. This means you need to know what personal information...
Guidance for the retail sector
The retail sector has obligations under the Privacy Act. If you’re a retailer, you need to make sure you have a plan for how to handle personal information...
Privacy Act does not stand in the way of protecting children from harm
The public inquiry into the disappearance of the Phillips children highlighted the failure of government departments to share vital information. Privacy Commissioner Michael Webster confirms that "A child's wellbeing and safety comes first."
Corporate
Information about the personal information we collect during recruitment, responding to Official Information Act requests, and when managing complaints made about us.
Case Note 329928 [2026] NZ Priv CMR 1: Personal emails sent from work email address “held” by Employer
A woman made an information request to her employer under principle 6 of the Privacy Act, and some information was withheld.