If a privacy breach is likely to cause serious harm, you must notify both the Privacy Commissioner and the affected individuals. Here's exactly what that means.
Unauthorised access, disclosure, loss, modification, or inability to access personal information — including hacking, sending to the wrong person, misplacing devices, and documents left in public places.
Assess: sensitivity of the information (health, financial, identity), potential for identity theft or fraud, safety implications, number affected, and vulnerability of those affected. When in doubt, notify.
Notify at privacy.org.nz/tools. Include: description of breach, information involved, how many affected, steps taken in response.
Tell them: what happened, what information was involved, what you are doing about it, what they can do to protect themselves, and your contact details.
Failing to notify a notifiable breach is an offence — fine up to $10,000. The Privacy Commissioner can also investigate and direct compliance.
Before you need it: who is responsible, how to assess severity, who to notify internally and externally, how to communicate with affected people, and how to document the incident.
Workstep gives your team instant answers from the Privacy Act, HIPC, and your own privacy policies.
Try Workstep free → Book a 20-minute demo