Which privacy law protects your student data in New Zealand?

Short answer first: the Privacy Act 2020 is the law. It treats every New Zealand university as an agency, and the 13 information privacy principles in section 22 give you the right to see what the University of Auckland, AUT, Waikato, Massey, Victoria University of Wellington, Canterbury, Lincoln or Otago holds about you, to have it corrected, and to be told before it goes overseas. A request goes to the university's privacy officer, who has 20 working days to respond. If the answer is wrong or late, the Office of the Privacy Commissioner takes complaints, but only after you have tried the university first.

This article covers your records as a student: the enrolment file, the learning platform logs, the lecture recordings and the analytics built on them. It reads the Act as it stands on legislation.govt.nz and the privacy statements of all eight universities, and it keeps apart what the university does with your data and what happens when you upload a recording to a tool you picked yourself.

Which law covers your data at a New Zealand university?

New Zealand has one privacy statute for the public and private sector alike, and universities sit inside it with everyone else. There is no separate student records law. Whether you may record a lecture in the first place is a different question, covered in recording lectures in New Zealand. This article is about the data once it exists.

• The Act covers every agency, and a university is one. Section 4 of the Privacy Act 2020 applies the Act to any New Zealand agency for any action it takes with personal information, wherever the information was collected or is held. All eight universities name the Act in their own privacy statements.
• Personal information means information about an identifiable individual. That is how section 7 defines it. Your marks, your log-in times, your Wi-Fi connections and your voice on a lecture recording all fit inside it.
• The rules are the principles in section 22, numbered 1 to 13. The Office of the Privacy Commissioner lists them on one page. A new principle 3A, about information collected from someone other than you, came into force on 1 May 2026 under the Privacy Amendment Act 2025 and sits after principle 3.
• Every agency must appoint a privacy officer. Section 201 requires it and says the job includes dealing with requests under the Act and working with the Commissioner on investigations. All eight universities publish the address to write to.

The rights below are not a courtesy the university extends. They are in the statute, and the wording of each university's statement differs while the law underneath does not.

What do the thirteen principles give you?

The principles run in the order information moves: collection, storage, access, use, disclosure. Not every one hands you a right you can exercise; some are duties on the university you hold it to when something has gone wrong. The table puts each in plain words, from section 22 as it read on the day of writing.

In practice you reach for three: principle 6 to get the record, principle 7 to fix it, and principle 12 to understand where it went. Access and correction requests have their own procedure in Part 4 of the Act, which is where the 20 working days come from.

What does your university hold about you?

The eight statements are more alike than different: seven follow the same skeleton of biographical details, contact details, education record, citizenship, ethnicity and National Student Number. The differences sit in what they say about teaching data. We read all eight. This is what they list.

• Enrolment and identity records at seven of the eight. Name, date of birth, contact details, citizenship or residency, ethnicity and iwi affiliation, National Student Number, education record, and passport and visa details where relevant. Otago adds, in some cases, creditworthiness information from credit reporters. Lincoln's policy names the enrolment process as a source and lists no categories.
• Lecture recordings at six of the eight. Auckland, AUT, Massey, Victoria, Canterbury and Otago list recordings among the personal information they collect. Auckland says it may audio or video record the lectures you attend and that your lecturer will usually advise you beforehand; its main statement adds that it may share those recordings with the other students who attended. AUT and Massey extend the list to tutorials and workshops. Waikato's and Lincoln's statements do not mention recordings. How each university records and keeps them is covered in lecture capture at New Zealand universities.
• Learning platform logs. AUT names logging into Canvas among the engagement data it gathers for learning analytics, with library use, the AUT app and Wi-Fi connections. Massey, Victoria and Canterbury list their learning management systems among the systems that collect information automatically, and Victoria says it may measure attendance at lectures and tutorials through analytics.
• Analytics and AI. Massey runs a data-enabled student support programme on enrolment, engagement and results data and gives an address to opt out. AUT describes a learning analytics pilot and says it will seek consent before using engagement data for targeted interventions. Massey names academic integrity assessment among the purposes of its profiling, and Auckland lists support for its academic integrity and discipline processes among the uses of your information.
• Not named anywhere: exam supervision and similarity software. None of the eight general statements names Turnitin, Inspera, a proctoring tool or any other similarity or supervision product. Several say the specific detail comes at the point of collection.

So the recording of you asking a question in week six is personal information the university holds, and so is the log showing you opened the course page at 2 a.m. before the test. Both are yours to ask for.

How do you ask for a copy of your records?

This is a principle 6 request, and Part 4 of the Act sets the procedure. The Office of the Privacy Commissioner says you can ask by email, letter, phone or in person, and only for your own information unless you act for someone else with written permission. Writing is easier to prove, and Lincoln asks for it.

1. Write to the privacy contact in the table below. Say you are making a request under principle 6 of the Privacy Act 2020, and name what you want: the whole file, or one thing, such as the recording of a named lecture.
2. Expect an identity check. Auckland, AUT and Victoria say they may verify who you are first, and Canterbury asks for details of your relationship with the university, so send the proof with the request.
3. Count 20 working days. Section 44 says the agency must respond as soon as reasonably practicable and in any case not later than 20 working days after the day it receives the request. Section 7 excludes weekends, the listed public holidays and every day from 25 December to 15 January, so a December request waits over summer.
4. Watch for an extension notice. Section 48 lets the university extend the limit for a large or complex request, but only by notice within the 20 working days that states the period, the reasons and your right to complain.
5. Do not pay by default. Section 66 lets a public sector agency charge only where the Commissioner has authorised it, and the Office says that in most circumstances you should not be charged.

What the university may withhold

Section 46 lets an agency refuse access only on the grounds in sections 49 to 53, and its notice must state the reason and your right to complain. Section 50 covers evaluative material, where references sit. Auckland's statement gives its own examples: legally privileged material, commercially sensitive information and information about other people. AUT adds work still in progress. A lecture recording carries other students' voices, so expect the university to weigh that before handing over a copy.

Seven of the eight state the 20 working days themselves. Lincoln's privacy policy, last modified in July 2024, does not repeat the number, which still applies because it sits in the Act.

How do you correct a record that is wrong?

A wrong home address is annoying. A wrong enrolment status or a placement report that describes someone else's incident can cost you. Principle 7 is the tool, and it does not end when the university says no.

• You may ask for a correction, and the same 20 working days apply. Section 63 says the agency must decide not later than 20 working days after receiving the request, and tell you whether it will correct the information or not.
• A refusal must come with a reason and your next two options. Under section 63(3) the notice must give the reason, tell you that you may provide a statement of the correction you sought, and tell you that you may complain to the Commissioner.
• The statement of correction travels with the record. Principle 7(4) says an agency that will not make the change must take reasonable steps to attach your statement so that it is always read with the information, and principle 7(5) says it must, so far as practicable, tell everyone it disclosed the record to. Auckland and Otago both describe the statement in their own words.

There is no general right to deletion. Victoria's statement says in terms that New Zealand law does not confer one, and seven of the eight cite the Public Records Act 2005 for records they must keep; Lincoln's policy does not name it. Canterbury is the most specific: it will delete the records of a prospective student who never attended, and assesses other requests against the Universities Disposal Schedule. Ask for correction when the record is wrong; ask for deletion only when it has no purpose left.

Who do you complain to when the university gets it wrong?

Two doors, in order. The first is the university's own privacy officer; the second is the Office of the Privacy Commissioner, which sends you back to the first if you skip it. Section 69 calls the thing you complain about an interference with privacy: a breach of a principle that causes harm, or a refusal of an access or correction request without proper basis. Missing the 20 working days counts as a refusal.

• The Office takes complaints only after you have tried the agency. Its complaints page sets out five steps and says it will not accept a complaint if you have not done step one, which is to try to work the issue out with the agency. Its online self-assessment cannot be saved part way.
• The Office settles, it does not punish. The same page says it cannot issue fines, make anyone accept a settlement offer, force an organisation to pay you money or force anyone to accept its findings, and that the wait for an investigator can be up to twelve months.
• The Human Rights Review Tribunal is the third door. Section 98 lets an aggrieved individual take proceedings to the Tribunal, and section 102 lists the remedies, including damages under section 103.

If the university loses your data

Sections 112 to 115 add a duty that runs the other way. A notifiable privacy breach is one it is reasonable to believe has caused serious harm, or is likely to. Section 114 requires the agency to notify the Commissioner as soon as practicable, and section 115 requires it to notify you. AUT's privacy hub says it will notify the Commissioner within 72 hours or as soon as practicable. Section 118 makes failing to notify the Commissioner an offence.

What happens when your data leaves New Zealand?

It leaves routinely. Cloud storage, email, the learning platform and the video system may all run on servers outside the country, and the universities say so. The Act keeps the university on the hook for information a provider holds for it, and sets conditions for information handed to a foreign entity for its own purposes.

• A processor's copy still counts as the university's. Section 11 says that where one agency holds information for or on behalf of another, for safe custody or processing, it is treated as held by the other agency, and it does not matter whether the processor is outside New Zealand. Section 11(5) adds that passing information to such a processor is not a use or disclosure. Principle 5, security, follows your record onto the overseas server.
• A disclosure to a foreign entity needs a listed condition. Principle 12 allows it only if you authorise the disclosure after being expressly told the recipient may not have to protect the information comparably, or the recipient is subject to the Act, or to privacy laws with comparable safeguards, or to a prescribed binding scheme or country, or is bound by an agreement providing comparable safeguards. The Office describes the aim as making sure the Act's protections continue to apply in the other country.
• The universities say where they stand. Canterbury stores most of the personal information it holds on Microsoft Azure cloud servers located in Australia. Auckland may transfer personal information to, or access it from, other countries, and where it can sends it only to countries with adequate privacy laws, naming New Zealand, Australia and the EU. Victoria, Waikato and Otago use cloud or data hosting providers in New Zealand and overseas and say the provider must protect the information as New Zealand law would; Massey says it complies with the Act's rules for cross-border transfer. AUT says it will tell you and seek your authorisation if a jurisdiction lacks similar protections. Lincoln requires the written consent of its privacy officer for any overseas disclosure.

So "is my data in New Zealand?" usually gets the answer "some of it is not, and the university remains responsible for it".

What changes when you upload a recording yourself?

Everything about who is responsible. The university's statement says nothing about the copy of a lecture you recorded on your phone and sent to a transcription app, because that copy is not the university's. Three things follow.

• The Act treats an individual acting for personal or domestic affairs differently. Section 27 says principles 1 to 3A and 4(b) do not apply to an individual collecting personal information solely for their personal or domestic affairs, and principles 5 to 12 do not apply to an individual holding it for that purpose where it was collected lawfully or created by them. Section 27(3) removes the exemption where the collection, use or disclosure would be highly offensive to a reasonable person. The Act does not say whether a study recording counts as personal affairs; it sets the test.
• The tool's own policy is the document that counts. Section 4 applies the Act to an overseas agency for actions taken in the course of carrying on business in New Zealand, and section 4(3) says that needs no place of business and no payment. Whether a given app falls inside that is not a question the Act answers for you. Read the app's privacy policy for four facts: where the audio is processed, when it is deleted, who its processors are, and whether you can export and delete your account. The price side of the choice is in the best note-taking app for New Zealand students.
• The university's promises do not travel with your copy. Canterbury's Azure servers in Australia apply to the university's copy. Your copy goes wherever your app sends it, and no principle 12 condition was applied on your behalf.

Before you upload a recording with other voices in it

A lecture recording holds the lecturer's voice and, in most rooms, the voices of students who asked questions. Their permission is a matter of the university's rules and the law on recording, covered in recording lectures in New Zealand. Ask before you record, and treat a yes as a yes for your own study unless the person said otherwise. Then keep three habits. Record only what you were allowed to record. Keep the file to yourself rather than in a shared drive. Delete the audio once the notes exist, on your phone and in the tool.

Where Notibo fits

Notibo records a lecture on your computer, or takes an audio file you upload, and returns a transcript, structured notes and flashcards. On the four facts this article says to check in any tool: files are stored in the EU, on Supabase in Frankfurt. Transcription and the AI notes run on US processors under standard contractual clauses. The audio file is deleted from storage as soon as the transcript and notes exist; if processing fails, it is kept for a short while so the recording can be tried again. The privacy policy lists the processors by name.

Notibo makes no claim under New Zealand law. What it can tell you is where the files go and when the audio is deleted, which is the check this article asks you to make of any tool. You get Pro free for 14 days, with 240 minutes of recording, and no card is asked for. After those 14 days the free plan gives 30 minutes of recording a month. Pro is 9.99 euro a month or 88.99 euro a year, with the local amount shown at checkout. Transcripts and notes export to PDF or Word.