Privacy Act and IT compliance for small business
The Privacy Act 2020 applies to almost every New Zealand business that holds information about people. We help with the IT side: knowing where personal information lives, controlling who can see it, keeping it secure and being ready if something goes wrong.
Privacy Act & IT compliance for small and medium businesses
Small businesses hold more personal information than they often realise. Client files, staff records, CVs from past job ads, customer emails with addresses and bank details, scanned identity documents, health notes in a booking system. It spreads across inboxes, shared drives, phones and old laptops. The Privacy Act 2020 expects you to take reasonable security safeguards for that information, keep it no longer than you need it and let people see and correct what you hold about them. Much of that comes down to how your IT is set up.
We start by finding where personal information actually sits. That means looking at shared folders, mailboxes, cloud apps, scanners that save to network locations and the forgotten drive under the reception desk. Then we check who can open it. It is common to find a staff folder readable by everyone, former employees whose accounts still work, or client documents shared with an anyone-with-the-link setting. Each finding is something practical to tighten.
We are not lawyers and do not give legal advice. What we do is help you put sensible technical safeguards in place, keep a record of them and make sure you can respond to a breach or an access request without panic. Every organisation must have a privacy officer; we work with yours, explain the technical choices in plain terms and point out where a question really needs your lawyer or the Office of the Privacy Commissioner's guidance.
What's included
Personal information map
A plain list of where personal information is stored across email, files, cloud apps and devices, and which systems hold the most sensitive kinds.
Access review
Folder and app permissions checked so staff see what their role needs, with ex-staff accounts closed and open sharing links tidied up.
Security safeguards
Multi-factor sign-in, device encryption, endpoint protection and patching put in place as the reasonable baseline most businesses should have.
Retention clean-up
Help finding and deleting information you no longer need, such as years of old CVs or closed client files, in line with the retention periods you set.
Breach readiness
A short process for spotting, containing and assessing a privacy breach, so you can decide on notification quickly and with the facts in hand.
Access request support
Search tools and steps for finding everything you hold about one person when they ask, across mailboxes, files and systems.
Cloud and overseas storage
A note of where each cloud service keeps data, so your privacy officer can consider the rules on sending personal information offshore.
Privacy officer briefing
A plain-English summary of your IT safeguards that your privacy officer can keep on file and update as things change.
Who is Privacy Act and IT compliance for?
This is a good fit for:
- Medical, allied health and other practices holding sensitive client details
- Accountants, lawyers and advisers handling financial and identity documents
- Recruiters and employers keeping CVs and staff records
- Businesses that have just appointed a privacy officer and want a starting point
- Offices that have had a near miss, such as an email sent to the wrong client
- Anyone asked by a client or partner to describe their data protection
Not sure where to start?
Our free IT health check looks at your devices, accounts, backups, security and network. You get a short written report with what is working, what is at risk and a price to fix it. No obligation.
Book the health checkPrivacy Act & IT compliance questions
Does the Privacy Act apply to small businesses?
Yes. The Act applies to agencies of every size that collect and hold personal information, including sole traders and small businesses. There is no minimum size exemption like some other countries have.
What counts as a notifiable privacy breach?
Broadly, a breach that has caused or is likely to cause serious harm to the people affected. If so, you must tell the Privacy Commissioner and affected people as soon as practicable. Your privacy officer makes the call, and the Commissioner's website has tools to help assess it.
Can you make us compliant?
Compliance is a business responsibility that includes policies, training and decisions only you can make. We cover the technical safeguards and records, and are clear about where a question needs legal advice instead.
Is storing data in overseas cloud services allowed?
Using reputable cloud services is common and generally workable, but the Act has rules about disclosing personal information overseas and you remain responsible for it. We tell you where each service stores data so your privacy officer can assess it.
Do we need a privacy officer?
Yes. Every organisation covered by the Act must have at least one. In a small business it is often the owner or office manager. It is a role, not a full-time job, and we help them with the technical side.
What about health information?
Health agencies have extra obligations under the Health Information Privacy Code. We set up the access controls, encryption and audit logging that support those obligations, and work with your practice's own guidance.
How do we start?
A privacy-focused IT review billed at our hourly rate gives you the information map, access findings and a ranked list of fixes. Ongoing safeguards then sit inside your support plan.
Other ways we help
Managed IT
One monthly price per person for support, security, updates and backups. Your outsourced IT team.
Managed IT
IT support
Remote and onsite help when you need it, billed by the hour. No plan, no contract.
IT support
Cyber security
Practical protection against scams, ransomware and account takeover, set up and kept current.
Cyber security