Data Breach Notification Law in New Zealand: A 2026 Guide

In New Zealand you are legally required to report a data breach only when it is likely to cause serious harm. The Privacy Act 2020 sets that serious harm test, and there is no fixed 72-hour clock, though as soon as practicable still applies. Here is what the law requires and how to be ready to make the call.

Notifiable Privacy Breach: What the Privacy Act 2020 Requires

Here’s the bit most Christchurch business owners get wrong. Not every data breach needs reporting. The Privacy Act 2020 only requires notification when a breach reaches the level of a “notifiable privacy breach.” That’s a specific legal test. Not a gut feeling.

A breach becomes notifiable when it has caused, or is likely to cause, serious harm to the people affected. Losing a laptop with a spreadsheet of customer names and phone numbers might sting. It may not clear the bar though. A leaked database with IRD numbers, health records, or banking details almost certainly will. The law asks you to weigh how sensitive the data is, whether it’s been encrypted, who might get hold of it, and what they could do with it.

This “serious harm” threshold sits at the centre of every compliance decision a business makes after an incident.

What Counts as Serious Harm

The Office of the Privacy Commissioner points to a few factors that push a breach into notifiable territory:

• The type of information involved, financial details and health records carry more weight than a name on its own
• Whether the data was protected by encryption or access controls at the time of the breach
• How many people are affected and whether they’re vulnerable, such as children or elderly clients
• What could realistically happen next, identity theft, financial loss, or reputational damage

We see this mistake all the time (usually with a server nobody’s thought about since 2019). A business assumes a breach is too small to matter. Then finds out later the data included something sensitive they’d forgotten was sitting on that server.

If a breach does meet the threshold, you must tell the Privacy Commissioner and the affected individuals as soon as practicable. There’s no fixed 72-hour clock like some overseas frameworks use. But “as soon as practicable” isn’t a licence to sit on it. Waiting weeks to figure out what happened rarely goes down well with regulators or clients.

Here’s a scenario we’ve talked through with a few local clients. A retail business in central Christchurch had a staff email account compromised through a phishing link. The account held customer order histories, including partial payment details. Was it notifiable? The business needed to weigh sensitivity, exposure, and likely harm before deciding, not after the fact. That took a proper security review. Not a guess over coffee.

This is where a lot of small and medium businesses fall short. They don’t have a clear process for assessing a breach when it happens. So they either overreact or underreact, and neither helps anyone. A security assessment done ahead of time, paired with a documented incident response plan, gives you the groundwork to make that call quickly and correctly when it counts.

We’ve supported Christchurch businesses through exactly this kind of assessment as part of broader cyber security consulting work. If you’re unsure whether your current setup would hold up to this test, sort it before an incident forces the question. Book a free IT and security review with our team on 0800242206 and we’ll walk through where you stand.

Who Must Be Notified and How the Timeline Works

Under the Privacy Act 2020, two groups need to know about a notifiable privacy breach. The Office of the Privacy Commissioner is one. The affected people are the other. You can’t pick just one.

If the breach has caused, or is likely to cause, serious harm, both need telling. This rule hasn’t shifted much since 2020. Enforcement has sharpened though.

So what counts as serious harm? Think financial loss, identity theft, reputational damage, or emotional distress. A Christchurch accounting firm that loses client IRD numbers and bank details is a different situation to a spreadsheet typo fixed within the hour. The law asks you to weigh how sensitive the data was, who might get hold of it, and whether it’s already been misused. There’s no fixed dollar figure or headcount that triggers notification. It’s a judgement call. That’s exactly why so many business owners get stuck.

Here’s the general sequence most businesses need to follow once a breach is confirmed:

1. Contain the breach first. Stop the bleeding before you start writing letters.
2. Assess the harm. Work out what data was involved and who’s affected.
3. Notify the Privacy Commissioner as soon as practicable. There’s no fixed day count in the Act, but “practicable” gets interpreted tightly.
4. Notify affected individuals directly where possible. Email or letter, not a buried website notice.
5. Keep a written record of what happened and why you made the calls you did.
6. Review what let the breach happen, and fix that gap before it repeats.

Notice there’s no “72 hours” rule like in Europe. New Zealand’s wording is looser. Don’t read that as relaxed. Businesses that sit on a breach for two or three weeks while they sort out logistics tend to draw more scrutiny, not less. We’ve seen firms treat the ambiguity as breathing room. It isn’t.

Direct notification is the expected standard. Public notices are only fine when you genuinely can’t reach people, say the contact details themselves were part of what got breached. Even then, the Commissioner expects you to show your working.

One thing trips up smaller operations. Staff.

If an employee’s payroll details or login credentials are exposed, they count as an affected individual too. It’s not just customers you’re accountable for.

We worked with a logistics operator in Hornby a while back where a phishing email led to a compromised email account with supplier invoices in it. The business assumed only customers mattered. But three staff members had their bank account details sitting in that inbox from an old HR form. They needed telling as well.

Getting the who and when right matters, but it only works if you already know what happened inside your systems. That’s the part most businesses can’t do alone.

The Real Challenge: Knowing What Happened Before You Can Decide

Here’s the part nobody warns you about. Under the Privacy Act 2020, you only have to notify people if a breach causes serious harm. Sounds simple. But you can’t judge harm until you know what happened, and that’s where most Christchurch businesses get stuck.

We’ve sat in on breach response calls where the owner asks “so do we need to tell anyone?” within the first ten minutes. Nobody can answer that yet. Not because anyone’s hiding anything. The honest answer is we don’t know what was accessed, when, or by whom.

Think about a ransomware hit on a Riccarton accounting firm. The attacker got in through a compromised remote desktop connection. Files got encrypted. Logs show access to a shared drive, but nobody’s sure if client tax records or just internal templates were touched. Until someone traces the attacker’s actual movement through the network, the business is guessing. And guessing is a bad place to make a legal call from.

This is the gap between “we had an incident” and “we know if this meets the serious harm threshold.” Closing that gap takes real forensic work, not assumptions. Most SMB owners aren’t trained for this, and they shouldn’t need to be. Running the business is the job. Figuring out attacker behaviour on a compromised server isn’t.

What needs answering before you can decide on notification:

• What systems or accounts were accessed, and for how long
• Whether personal information was viewed, copied, or just sat there untouched
• If credentials were reused elsewhere, opening up other accounts
• Whether the data involved was sensitive enough to cause real harm if exposed
• How the attacker got in, so you can confirm the door is closed

Get any of these wrong and the fallout gets worse. Under-report because you assumed no harm, and you risk a complaint to the Privacy Commissioner later. Over-report out of caution, and you’re managing needless panic among staff and clients. Neither outcome is good. Both come from the same root problem. Not knowing what happened fast enough.

We’ve seen businesses spend three weeks trying to answer these questions internally with IT staff who normally handle helpdesk tickets, not incident investigation (that’s a different skill set entirely, and a fair one to not have in-house). Three weeks is a long time when the Privacy Act expects notification as soon as practicable.

This is exactly why a proper security assessment matters before you’re in crisis mode, not during it. Logging, monitoring, and a documented response plan turn “we’re not sure” into “here’s exactly what happened” in hours, not weeks. If your business handles customer data and you’re not sure your systems would give you clear answers fast, have that conversation now. Not after an incident lands on your desk. Call us on 0800242206 to talk it through.

Related reading

• Are companies legally required to notify you of a data breach?
• What is a notifiable privacy breach? Definition and examples
• Cyber insurance requirements in NZ
• What cyber insurance underwriters ask

Frequently asked questions