Subject Access Request (New Zealand)

A Subject Access Request (SAR) — formally known as a request for access to personal information — is a right exercised by an individual under the Privacy Act 2020 to obtain a copy of, or access to, personal information held about them by any agency. Information Privacy Principle 6 (IPP 6) under the Privacy Act 2020 provides the right of access: where an agency holds personal information about an individual, the individual is entitled to request access to that information, and the agency must, as soon as reasonably practicable, and in any case no later than 20 working days after receiving the request, comply with the request by making the information available to the individual or giving the individual reasons for refusing access. 'Agency' under the Privacy Act 2020 is broadly defined to include all private sector organisations, businesses, government departments, health providers, schools, employers, and other bodies that hold personal information about identifiable individuals, with limited exceptions for small businesses in certain contexts. 'Personal information' means any information about an identifiable individual, including name, contact details, financial information, health information, employment records, communications, and any other data that identifies or could identify the individual. There is no fee payable for a subject access request in New Zealand. The Privacy Act 2020 strengthened enforcement mechanisms compared to the Privacy Act 1993, including a mandatory notifiable privacy breach regime and increased powers for the Privacy Commissioner.

Under the Privacy Act 2020, an agency must respond to a Subject Access Request (SAR) as soon as reasonably practicable, and in any case no later than 20 working days after receiving the request. Note that 'working days' under New Zealand law excludes Saturdays, Sundays, and public holidays — the response period is therefore typically 4 calendar weeks but may be longer during periods containing public holidays. The agency may extend the response period by a further 20 working days if the request requires a large amount of searching or a large amount of information to be reviewed, or if complying with the request within the initial period would unreasonably interfere with the agency's operations. To extend the period, the agency must notify the individual of the extension and the reasons for it within the initial 20 working day period. If the agency refuses access to all or any of the requested information, it must give written notice of the refusal and the reasons for it within the 20 working day period, and must inform the individual of their right to make a complaint to the Privacy Commissioner. If an agency fails to respond within the required timeframe without a valid extension, the individual can complain to the Privacy Commissioner, who can investigate the delay and direct the agency to respond. Agencies that charge fees for subject access requests, impose unreasonable conditions, or routinely fail to meet response deadlines risk enforcement action by the Privacy Commissioner under the Privacy Act 2020.

Under the Privacy Act 2020, an agency may refuse a Subject Access Request (SAR) on limited grounds set out in ss 49–53 of the Act. The main grounds for refusal include: withholding on grounds of serious threat to safety — where disclosure would be likely to endanger the safety of any individual; withholding on grounds of legal professional privilege — where the information is the subject of legal professional privilege; withholding to protect the privacy of third parties — where the information is about another individual and it would be an unwarranted disclosure of that person's personal information; withholding to protect confidential sources — where the information was provided by a person who had a reasonable expectation of confidence; withholding on grounds of prejudice to law enforcement — where disclosure would prejudice law enforcement, or the maintenance of the law; withholding for reasons of national security; and where the disclosure of the information would breach another enactment. The agency bears the burden of establishing that a ground for refusal applies. If the agency partially refuses access — providing some but not all of the requested information — it must explain which information is withheld and the reason. The individual can challenge a refusal by making a complaint to the Privacy Commissioner under s 69 of the Privacy Act 2020. The Commissioner can investigate and, if the refusal is found to be unjustified, can direct the agency to provide access through a compliance notice. Ultimately, the matter can be referred to the Human Rights Review Tribunal.

Yes. Under the Privacy Act 2020, employees have the right to request access to personal information held about them by their employer, subject to the same grounds for refusal that apply to any agency. Personal information that an employer typically holds about an employee includes: employment contract and any variations; personal details including name, address, date of birth, and IRD number; performance reviews and appraisals; disciplinary records and written warnings; payroll and remuneration records; leave records; correspondence relating to the employee; and any other information that identifies the employee. An employee making a SAR to their employer should be specific about what information is sought — a targeted request is more likely to receive a complete and timely response than a very broad request for 'all information'. Employers must respond within 20 working days under the Privacy Act 2020. Note that in the employment context, there are overlapping rights to disclosure under the Employment Relations Act 2000 — for example, in a personal grievance investigation, the employer has duties of natural justice under s 4 of the Employment Relations Act 2000 to provide the employee with access to information relevant to any disciplinary decision. In practice, employees involved in disciplinary processes should consider exercising both their Privacy Act 2020 SAR rights and their Employment Relations Act 2000 rights to obtain relevant documents.

A Subject Access Request (New Zealand) does not legally require a lawyer in New Zealand, and individuals and businesses may draft and execute the document independently. The Contract and Commercial Law Act 2017 does not mandate legal representation for the creation or signing of this type of document. However, seeking independent legal advice from a qualified New Zealand lawyer is recommended for transactions involving substantial financial value, complex regulatory requirements, or cross-border elements where multiple legal jurisdictions may apply. A lawyer can verify that the document complies with all applicable statutory requirements, identify potential risks specific to the transaction, and confirm that the terms adequately protect the interests of all parties involved. The High Court of New Zealand has jurisdiction over disputes arising from this type of document, and Companies Office may impose additional compliance obligations depending on the nature of the underlying transaction. Professional legal review is particularly advisable where the document will be submitted to government agencies or used as evidence in legal proceedings.