Notifiable privacy breaches: when and how to report in New Zealand

What counts as a privacy breach

A privacy breach is unauthorised or accidental access to, or disclosure, alteration, loss or destruction of personal information, or anything that stops you accessing it. That covers far more than hacking. An email with a spreadsheet of client details sent to the wrong person is a breach. So is a lost unencrypted USB drive, a ransomware attack that encrypts records, a staff member browsing files they had no reason to see, or paper files left in a skip. Many breaches are small and harmless, and only some are notifiable. But every one should be recorded and assessed, because you need to show you thought about it.

Assessing serious harm

The Act lists factors to weigh. What kind of information was involved, and how sensitive is it? Health details, financial information, identity documents, IRD numbers and information about children carry more risk. Who obtained it, and could they misuse it? What steps have you taken to reduce harm, such as recovering the data or getting a written assurance of deletion? Was the information protected, for example by encryption? Serious harm can be physical, financial, emotional or reputational, and includes significant humiliation, loss of benefit or identity theft risk. A misdirected email to a trusted client who confirms deletion may not be serious. A database of passport scans published on a leak site almost certainly is.

Who to tell and when

If you conclude serious harm is likely, notify the Office of the Privacy Commissioner as soon as practicable. The Commissioner's online tool, NotifyUs, guides you through the questions and helps decide whether the breach meets the threshold. You must also notify the affected people, or if that is not reasonably practicable, give public notice. There is no fixed number of hours, but as soon as practicable means promptly, not after you have finished every investigation. You can update the Commissioner as you learn more. Unreasonable delay can be criticised, and failing to notify a notifiable breach can be an offence carrying a fine.

What to tell affected people

Notices should explain in plain language what happened, what information about them was involved, what you are doing about it, what they can do to protect themselves and who to contact with questions. Avoid legal jargon and avoid minimising. Practical advice matters most: change passwords, watch for scam emails using their details, or contact their bank if account numbers were exposed. Identify a named contact and make sure that person is ready for calls and emails. Prepare short answers to the obvious questions so everyone answering gives consistent information.

Preserve, contain and record

While assessing, contain the breach. Recall or request deletion of misdirected email, disable compromised accounts, revoke shared links, and secure physical records. Preserve evidence such as logs and the original email, because you may need them for your assessment, your insurer or the Commissioner. Keep a breach register. Record every incident, notifiable or not, with the date, what happened, the information involved, your harm assessment, the decision and the reasons. The register helps you spot patterns, such as the same email autocomplete mistake recurring, and it is good evidence that you take privacy seriously.

Reducing the chance of notifiable breaches

Most notifiable breaches in small businesses come from a few causes: email sent to the wrong person, compromised mailboxes, ransomware and lost devices. Each has a practical fix. Turning off autocomplete for external addresses or adding a delay before sending, MFA on every mailbox, encrypted laptops and tested backups all reduce both the chance of a breach and the harm when one occurs. Reducing what you hold helps too. Information you have deleted cannot be breached. Combine retention rules with good security and many incidents that would have been notifiable become minor events with nothing to report.

Two short examples

An accounts clerk at a property management firm emails a rent arrears report to the wrong tenant because the address autocompleted. The report lists twelve tenants' names, addresses and amounts owing. The firm phones the recipient within the hour, who deletes it and confirms in writing. The information is moderately sensitive, it went to one identifiable person who cooperated, and the harm appears contained. The firm records the incident, its reasoning and the confirmation, and decides notification is not required, while reviewing its email settings.

A physiotherapy clinic discovers that a staff mailbox was accessed by an unknown overseas sign-in for three weeks. The mailbox contained referral letters with patient health details. The clinic cannot tell exactly what was read. Health information is highly sensitive, the attacker is unknown and possibly malicious, and the data was not protected. That breach is very likely notifiable, and the clinic should notify the Commissioner and patients promptly, updating them as the investigation continues.