Office of the Privacy Commissioner, New Zealand

What Office of the Privacy Commissioner, New Zealand does

The Office of the Privacy Commissioner (OPC) is New Zealand's statutory privacy regulator, established in 1993 under the Privacy Act 1993 and continuing its mandate under the Privacy Act 2020. It is an independent Crown Entity headquartered in Wellington with approximately 45 employees, led by Privacy Commissioner Michael Webster. OPC's core functions are the investigation of privacy complaints, conducting own-motion inquiries, issuing compliance notices, providing policy advice to government agencies, and educating the public on privacy rights. It serves three primary segments: New Zealand citizens and residents exercising privacy rights, government agencies and public sector organisations subject to compliance obligations, and private sector organisations covered by the Privacy Act 2020.

OPC operates a portfolio of digital services including NotifyUs (an online breach notification system with self-assessment and encrypted reporting), the Privacy Complaint Form, AboutMe (an individual information request tool), the Privacy Statement Generator, the Response Date Calculator, ten free e-learning modules, and the AskUs knowledge base containing 650+ answered privacy questions. The underlying technology stack consists of government web platform components (New Zealand Government Marketplace, hosted on Microsoft Azure per a documented Privacy Impact Assessment) with Matomo used for non-identifiable traffic analytics. Referrals and support coordination are maintained with NCSC, Netsafe, ID Care, and Community Law.

OPC does not operate a commercial revenue model. It is funded entirely through parliamentary appropriations and provides all services free of charge. Its go-to-market is regulatory and informational rather than commercial, with public education conducted through the Rangitaki blog, Privacy News newsletter, RSS feeds, media releases, annual privacy surveys, and webinars. In March 2026, OPC restructured its public enquiry service, closing the dedicated enquiries email and redirecting to a menu-driven 0800 hotline and self-service website, in response to sustained high demand.

Name

Office of the Privacy Commissioner, New Zealand

Legal name

Office of the Privacy Commissioner

Website

https://privacy.org.nz

Company type

Private

Founded year

1993

Operating status

Operating

Headcount range

11–50 employees

Short description

The Office of the Privacy Commissioner is New Zealand's independent Crown Entity privacy regulator, established in 1993, that investigates privacy complaints, issues compliance notices, advises government, and educates the public on privacy rights under the Privacy Act 2020.

Ownership category

akta.pro rank

Product category

Government Privacy Regulation

NAICS

Public Administration (92)

akta.pro primary industry

Privacy Governance & Consent Management (HDADAIAI)

akta.pro secondary industry

Privacy Management (Consent, DSAR, RoPA) (HDADAFAH)

Keywords

• Privacy regulation
• Data protection oversight
• Privacy complaints handling
• Breach notification services
• Privacy compliance guidance

GTM type

B2B and B2C

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D

Distribution channels4 records

Marketing channels7 records

Core offering

The Office of the Privacy Commissioner (OPC) is an independent New Zealand Crown Entity that administers the Privacy Act 2020, handling privacy complaints, investigating data breaches, issuing compliance notices, and providing regulatory guidance to agencies, businesses, and individuals. It also delivers public education, training, and self-help digital tools to support privacy compliance across New Zealand.

Product overview

The Office of the Privacy Commissioner operates a suite of digital services focused on privacy regulation, complaint handling, and public education. The portfolio consists of core regulatory services (NotifyUs breach reporting, Privacy Complaint Form), self-service tools (Privacy Statement Generator, AboutMe, Response Date Calculator), educational resources (E-Learning with 10 modules, AskUs knowledge base with 650+ questions), and research tools (annual Privacy Survey). The service model shifted in March 2026 to prioritise self-service through the knowledge base and website, closing direct email enquiries in favour of automated assistance.

Differentiator

Problem solved

Functional benefit

Brands

• Tūhono│Connect: OPC's communications and engagement platform providing news, media releases, newsletter subscriptions, blog (Rangitaki), surveys, events, and contact services.
• Rangitaki
• AskUs Knowledge Base
• Privacy News
• AboutMe (Request My Info Tool)
• CARAF
• Poupou Matatapu

Products and services

• NotifyUs (Privacy Breach Notification Service)

Segments3 records

Ideal customer profiles2 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature4 records

Partnerships

Six partnerships are on record, tiered support partner, infrastructure partner and referral partner.

• National Cyber Security Centre (NCSC)support partnerOthersNCSC is recommended as a contact for organisations wanting to report or get guidance about cyber security breaches. OPC refers individuals and organisations to NCSC when appropriate.
• ID Caresupport partnerOthersIdentity and cybersecurity support service that OPC refers breach-affected individuals and organisations to for additional support.
• Netsafesupport partnerOthersOnline safety organisation that OPC refers breach-affected individuals and organisations to for support with online safety issues related to privacy breaches.
• Department of Internal Affairsinfrastructure partnerTechnology or IntegrationOPC uses components of the New Zealand Government Marketplace web platform managed by the Department of Internal Affairs. Vulnerabilities in the Marketplace are passed to DIA for resolution.
• Microsoftinfrastructure partnerTechnology or IntegrationOPC has conducted a Microsoft Azure Privacy Impact Assessment, indicating Microsoft Azure is used as cloud infrastructure for the office's systems.
• Community Lawreferral partnerOthersFree legal advice service that OPC recommends individuals contact for customised privacy help beyond what the office can provide.

Recent moves6 records

Expansion highlights5 records

Broad incumbents

• Commission Nationale de l'Informatique et des Libertés (CNIL): France's independent data protection authority under GDPR, with prominent enforcement record and EU-wide influence. Comparable statutory authority to OPC, but with significantly larger scope, resourcing, and EU regulatory weight.
• Information Commissioner's Office (ICO): UK's independent data protection and information rights regulator, overseeing GDPR-equivalent UK GDPR and Data Protection Act. Larger, more resourced peer with a comparable statutory mandate spanning privacy, information rights, and freedom of information.
• Dutch Data Protection Authority (Autoriteit Persoonsgegevens): Netherlands' independent privacy regulator under GDPR, with comparable statutory authority, complaint handling, and notable enforcement history. Larger and more resourced than OPC but with a parallel mandate.

Emerging players

• OneTrust: Private-sector privacy management software platform that serves the same populations (citizens, businesses, agencies) as OPC's NotifyUs, Privacy Statement Generator, and consent management tools. Adjacent rather than competing (no regulatory authority), but functionally similar governance tooling.

Direct peers

• Privacy Commissioner under the Privacy Act 1988: Australian privacy-specific function historically housed within OAIC; functions are comparable to OPC's privacy-specific mandate under NZ Privacy Act 2020.
• Personal Data Protection Commission (PDPC) Singapore: Singapore's data protection regulator administering the Personal Data Protection Act 2012. Mirrors OPC's role in complaint handling, breach reporting, and enforcing privacy obligations on organisations.
• Office of the Privacy Commissioner of Canada: Canada's national privacy regulator enforcing the Privacy Act and Personal Information Protection and Electronic Documents Act (PIPEDA). Operates with similar complaint investigation, breach guidance, and public education functions as OPC NZ.
• Office of the Australian Information Commissioner (OAIC): Australia's national privacy regulator, enforcing the Privacy Act 1988 and similar functions of complaint handling, breach notification, and public guidance. Closest cross-Tasman counterpart to OPC with parallel mandate and structure.

Regional players

• Privacy Commissioner for Personal Data (Hong Kong): Hong Kong's independent statutory privacy regulator under the Personal Data (Privacy) Ordinance. Comparable functions of complaint handling, breach investigation, and compliance promotion, though operating in a different jurisdiction.
• Office of the Information and Privacy Commissioner of Ontario: Ontario's provincial privacy and information commissioner enforcing PHIPA and FIPPA. Operates a comparable scope of complaint resolution, breach investigation, and public guidance at the sub-national level, analogous to OPC's narrower national remit.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat3 records

Key risks5 records

Key highlights5 records

Customer concentration

• LinkedInlinkedin.com/company/office-of-the-privacy-commissioner

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Office of the Privacy Commissioner, New Zealand