Office of the Privacy Commisioner in New Zealand:
https://www.privacy.org.nz/the-privacy-act-and-codes/privacy-act-and-codes-introduction/
The Privacy Act controls how 'agencies' collect, use, disclose, store and give access to 'personal information'.
The privacy Codes of Practice do the same, but they apply to specific areas - particularly health, telecommunications and credit reporting.
Personal information is information about identifiable, living people.
Almost every person or organisation that holds personal information is an 'agency'. So, for example, the Privacy Act covers government departments, companies of all sizes, religious groups, schools and clubs.
...individuals who collect or hold personal information for their own personal, family or household affairs are exempt -- although this ceases to apply once the personal information concerned is collected, disclosed, or used, if that collection, disclosure, or use would be highly offensive to an ordinary reasonable person.
...An interference with privacy can occur when:
(a) an agency wrongfully refuses to give an individual access to information about them, or wrongfully refuses to correct information about them, or
(b) an individual suffers some form of harm as a result of a breach of a privacy principle, rule, or a code of practice or information matching provision.