The Privacy Act 2020: what it means for your business IT

Who the Act applies to

There is no small business exemption. A two-person bookkeeping practice, a dental clinic, a builder with a customer list and a retailer with an online store are all agencies under the Act if they collect information about identifiable people. That includes staff records, not just customers. The Act sets out information privacy principles that cover collecting, storing, using, sharing and deleting that information. Each business should have a privacy officer. In a small firm that is usually the owner or office manager rather than a dedicated role. Their job is to understand the obligations, handle requests from people wanting their information and lead the response if something goes wrong.

Security safeguards: what reasonable looks like

Principle 5 requires reasonable security safeguards against loss, unauthorised access, use, modification or disclosure. The law does not list specific technologies, because what is reasonable depends on how sensitive the information is and how much of it you hold. A medical practice storing health records is expected to do more than a cafe with a loyalty email list.

In practical terms, reasonable for most offices today means multi-factor sign-in on email and cloud services, encrypted laptops, access limited to the people who need it, patched systems, tested backups and staff who know how to spot scams. If an incident happens, those are the measures you will be asked about.

Keep less, for less time

Principle 9 says you should not keep personal information longer than you need it for a lawful purpose. Many businesses hold years of old records simply because nobody deleted them: CVs from unsuccessful applicants, scanned driver licences from one-off transactions, customer files from long-closed accounts. Every one of those files becomes part of the damage if you are breached. Set retention periods that match your legal and business needs. Tax and employment law require some records to be kept for set periods; beyond that, delete or anonymise. Microsoft 365 retention labels and policies can automate much of this once the rules are decided.

Sending information overseas

Principle 12 deals with disclosing personal information to organisations outside New Zealand. Storing data in a cloud service you control is generally treated differently from handing it to an overseas business for its own use, but you still need to understand where your providers keep data and what protections apply. When you share customer data with an overseas company, for example a marketing platform, check that comparable safeguards apply. Keep a simple list of the systems that hold personal information, where they are hosted and who has access. That list makes privacy decisions, supplier reviews and breach assessments much faster.

Access and correction requests

People have the right to ask for the personal information you hold about them and to ask for corrections. You generally have 20 working days to respond. That is hard to meet if information is scattered across personal inboxes, old shared drives and USB sticks. Organised storage, searchable mailboxes and clear ownership of each system make requests routine instead of stressful. Microsoft 365's search and eDiscovery tools can locate emails and documents mentioning a person across the tenant, which helps with larger requests. Make sure whoever handles requests knows these tools exist.

Breaches and staying current

When a privacy breach is likely to cause serious harm, the Act requires you to notify the Privacy Commissioner and affected people as soon as practicable. Failing to notify can be an offence. Having encryption, access logs and a written response plan in place makes it much easier to assess an incident quickly and accurately. Privacy law continues to evolve, with amendments and codes such as the Health Information Privacy Code adding detail for particular sectors. Check the Privacy Commissioner's website for current guidance rather than relying on summaries, and review your practices each year.

A practical starting checklist

If you are not sure where to begin, start with a short inventory. List the main places personal information lives: email, the accounting system, the practice management or CRM system, shared drives, paper files and any spreadsheets that get emailed around. Note who has access to each and whether that access is still appropriate. That single page answers most of the questions the Act raises and shows you where to focus effort first.

Next, check the basics on each system: MFA on, access limited to the right people, data backed up, and a sensible retention period. Update your privacy statement so it accurately describes what you collect and why, and make sure staff know who the privacy officer is and how to raise a concern. None of these steps needs a large budget, and together they cover a large share of what a reasonable business is expected to do.