Data Breach? What the Privacy Act 2020 Requires You to Do

When the Privacy Act 2020 triggers

Since December 2020, New Zealand organisations must notify the Privacy Commissioner of a notifiable privacy breach - a breach that has caused, or is likely to cause, serious harm to affected individuals. 'Serious harm' includes identity theft, financial loss, and serious humiliation or reputational damage.

Not every incident is notifiable. An internal error with no real risk of harm, caught and contained, may not need notification. The test is harm to individuals, not embarrassment to your business.

The obligation to notify affected people

If the breach is notifiable, you must also notify affected individuals as soon as practicable, with practical advice on what they can do - changing passwords, watching for phishing, placing alerts. The Commissioner must be notified first, and your notification must be genuine, not a press release written to bury the news.

The first 24 hours

Before any notification, you need facts: what data was involved, how it happened, how far it spread, and whether it's still happening. That means containing the incident, preserving evidence (more on that in our evidence guide), and documenting what you know as you learn it.

Notification deadlines are measured in days, not hours - but acting fast on containment and evidence preserves your options. A calm, documented response beats a panicked one.

What good looks like

The organisations that handle breaches well have three things in place before anything happens: a tested incident response plan, a clear internal owner, and backups that actually restore. The ones that suffer most are the ones improvising for the first time.