A notifiable privacy breach in New Zealand is one that is likely to cause serious harm to the people whose personal information was accessed, lost, changed or disclosed without permission. Not every mistake qualifies; the outcome matters more than the cause. Here is the plain-English definition, with real Christchurch examples.
What Counts as a Privacy Breach Under NZ Law
A privacy breach means personal information is accessed, changed, lost, or disclosed without permission. That’s the Privacy Act 2020 definition. Not every breach needs a report. You only notify when serious harm is likely. (This is a big sticking point for many Christchurch businesses, by the way). We see this confusion constantly.
But a simple typo isn’t always a notifiable breach. Not automatically. If that typo sends a client’s medical file or bank details to the wrong person, it’s a different story. The breach’s cause matters less than its outcome. It’s about the harm to the person involved.
Common Breach Scenarios We See in Christchurch Businesses
We work with local firms. We see the same patterns. These are common privacy breaches:
- An email with client invoices or health records sent to the wrong person.
- A staff laptop or phone stolen from a car, unencrypted, with customer data on it.
- A phishing attack that gives an attacker access to a staff mailbox full of client details.
- A misconfigured cloud folder that leaves files open to the public without a password.
- A former employee’s account that stays active and gets used to pull customer data after they’ve left.
These are all breaches. Notifiability depends on the serious harm test. We cover that later.
What the Privacy Act Covers
The Privacy Act 2020 covers information that identifies a person. Names, addresses, dates of birth. Health records. Financial details. Sometimes even IP addresses. It applies to everyone. From a small retailer in Sydenham to a 150-staff logistics firm near Christchurch Airport. If you hold personal data on customers, staff, or suppliers, you’re covered.
The Office of the Privacy Commissioner oversees this. They are clear: breaches aren’t just about hacking. Malicious intent isn’t always involved. We help clients respond to many breaches. Often they are simple mistakes. Not cyber attacks. A staff member might CC the wrong list. A supplier database gets shared without proper checks. These still count,. Many people miss this.
How do you know if your business event is a legal breach? Ask three questions. Was personal data accessed, lost, or disclosed without permission? Did it identify a real person? Could it realistically cause harm? Think financial loss, safety risk, or bad embarrassment.
Say ‘yes’ to those? You likely have a breach. It needs proper assessment.
Here’s a point most people miss: internal breaches happen. By the way, a staff member snooping through HR files is still a breach. Even if the data never leaves your building.
Getting this definition right matters. It shapes everything that follows. Notifying people, reporting to the Commissioner, it all stems from this. Get it wrong, you risk under-reporting a serious issue or causing unnecessary panic.
The Serious Harm Test: What Makes a Breach Notifiable
Not every privacy mistake needs a report. The Privacy Act 2020 is clear. A breach is only notifiable if it has caused, or is likely to cause, serious harm. This is the serious harm test. It draws the line between an internal fix and a legal duty to inform the Office of the Privacy Commissioner and anyone affected.
What is ‘serious harm’? The Act gives no single definition. It lists factors you weigh. We guide Christchurch clients through this often. It usually boils down to four questions.
- What kind of information was exposed? How sensitive is it?
- Who got access to it? Could they misuse it?
- What could happen to the affected person? Think financially, physically, or emotionally.
- Were there any protections in place? Like encryption, to reduce the risk.
Health records. Financial details. Government ID numbers. These are high risk. A staff name and email spreadsheet might just be annoying. It probably won’t clear the serious harm bar. But add bank accounts or IRD details? The picture changes fast. And suddenly it’s a real problem.
We see this scenario often. A staff member emails a client list to the wrong person. A simple mistake. If it’s just names and phone numbers, harm is unlikely. Most businesses log it, review the process. Then they move on. But if that list holds payment details or health notes? The risk jumps. That’s a very different conversation. You’ll notice the difference immediately.
Encryption also matters. A stolen laptop with encrypted data? The risk of data being read is low. But unencrypted data on a lost device is a much bigger problem. This is why we push encryption and multi-factor authentication. We do this with all our Christchurch clients. It just makes sense.
And timing plays a part. Many business owners get caught here. You cannot wait to see if harm happens. The test is for likely harm. Not confirmed harm. If a reasonable person expects real damage, you act. Even if nothing bad has happened yet.
But we’ve seen cases where businesses assumed no harm. Nobody complained. That’s not the test. The question isn’t angry phone calls. It’s whether a reasonable person looking at the facts would say, ‘Yes, this could genuinely hurt someone.’, this is where most people get it wrong.
This judgement call trips up busy owners. They lack a security background. It’s why a proper cyber security audit matters. Get an assessment done before a breach. Not after.
Notifiable vs Non-Notifiable Breaches: Real Examples
Not every privacy mistake needs a report. The Privacy Act 2020 has a clear test. A breach is notifiable when it causes, or is likely to cause, serious harm. That word ‘serious’ is important. A misfiled invoice might be embarrassing. A leaked customer database with names, addresses, and health details? That’s a different problem altogether.
We get asked about this a lot. During security reviews with Christchurch businesses. Most owners think any mistake means a report. It doesn’t. But the opposite is also true. And it often catches people out.
Here’s how it works. These are incidents we see across Canterbury SMBs:
- Non-notifiable: An email sent to the wrong internal staff member, quickly recalled, no external party ever opened it.
- Non-notifiable: A password reset email that bounces and lands in a spam folder with no personal data attached.
- Likely notifiable: A staff laptop stolen from a car in Riccarton with unencrypted client files and no remote wipe set up.
- Likely notifiable: A phishing attack that compromises a staff email account holding customer payment details or health records.
- Likely notifiable: A ransomware attack that locks or exports client data from your server, even if you pay to get it back.
And you see the pattern. It’s not about the mistake. It’s about what was exposed. Who got to it. What they could do. A lost laptop with strong disk encryption and remote wipe? That might not need notification. The same laptop with no encryption? That almost certainly does.
Last year, we worked with a Christchurch firm. Professional services. A laptop was stolen from an unlocked vehicle near Hagley Park. The device had full disk encryption. It was remotely wiped within the hour. They assessed it as low risk. No notification needed. But compare that. Another firm’s device had no encryption. Client tax file numbers, bank details, contact records. All in plain text. That one needed reporting. It needed it fast.
Ransomware is different. And here’s what surprises people. Paying the ransom does not make the breach disappear. If attackers accessed personal information at any point, that’s usually enough. It triggers the serious harm test. Regardless of if you got your data back. That’s a hard lesson for many.
So, how do you tell the difference? Before it turns into a crisis? Ask three questions. Was personal information accessed? Not just theoretically at risk. Was it sensitive? Think health, financial, ID details. Could someone use it for real harm? Financial loss, identity theft, reputational damage. Say ‘yes’ twice or more? You’re probably in notifiable territory.
This is why encryption matters. Access controls too. Quick incident response. Business owners often underestimate their importance. They don’t just stop breaches. They shrink the legal fallout. Lower risk. More time back. Talk to the team on 0800242206. Or book a free IT and security review.
Related reading
- Data breach notification law in NZ: a 2026 guide
- Are companies legally required to notify you?
- Cyber insurance requirements in NZ
Frequently asked questions
You must report a notifiable breach to the Office of the Privacy Commissioner as soon as practicable after you become aware of it. There's no fixed number of days in the Privacy Act 2020, but delays raise questions about whether you took the risk seriously. Christchurch businesses we work with usually aim to notify within days, not weeks. Waiting to see if someone complains isn't acceptable. The clock starts the moment you have enough facts to suspect serious harm is likely.
Failing to report a notifiable breach can lead to fines and formal action from the Office of the Privacy Commissioner. It also damages trust with your customers and staff once they find out later. Many Christchurch business owners assume silence is safer, but it usually makes things worse. Getting a proper cyber security audit for your Christchurch business helps you spot breaches early and respond the right way, before regulators or clients find out on their own.
Yes, small businesses in Christchurch are just as exposed as large ones. A retailer in Sydenham holding customer loyalty details has the same legal duties as a large firm near Christchurch Airport. Attackers often target smaller businesses because their systems are less protected. Size doesn't reduce your obligations under the Privacy Act 2020. If you store names, emails, or payment details, you're covered and need a plan for handling a breach.
A privacy breach specifically involves personal information about a real person, while a data breach can involve any type of data, including business records with no personal details. Under the Privacy Act 2020, only breaches touching personal information trigger notification duties. This mix-up trips up a lot of Christchurch business owners. Knowing the difference helps you decide quickly whether an incident needs a formal response or just an internal fix.
You need to tell both the Office of the Privacy Commissioner and the people whose information was affected. This is a common misconception; some owners think telling one is enough. Both notifications matter because affected people need to protect themselves, and the Commissioner tracks patterns across Christchurch and the rest of the country. Skipping either step leaves you exposed to complaints and follow-up questions later.
Encryption, staff training, and removing old accounts quickly all lower your risk of a notifiable breach. Simple habits, like double-checking email recipients and locking down cloud folders, stop many of the breaches we see in Christchurch. A regular cyber security audit for your Christchurch business catches weak spots before they turn into a legal problem. Prevention is far less stressful than managing a breach after it happens.
