Many NZ businesses that experience a cyber incident don't know whether to report it, to whom, or what reporting triggers mandatory versus voluntary notification. Here's the reporting landscape for NZ businesses — CERT NZ, the Privacy Commissioner, NZ Police, and your insurer.
The reporting obligations following a cyber incident in New Zealand are widely misunderstood. Many businesses believe reporting to CERT NZ is mandatory and that not reporting creates legal exposure. Others believe that because CERT NZ can't take enforcement action, reporting is pointless. Both views are incorrect.
CERT NZ: Voluntary Reporting, Real Value
CERT NZ (cert.govt.nz) is the New Zealand government's Computer Emergency Response Team. Reporting to CERT NZ is voluntary — there is no legal requirement to report a cyber incident to them. However, there are compelling reasons to do so: CERT NZ provides free expert assistance to NZ organisations during cyber incidents, including technical guidance on containment, recovery, and forensics. They also use aggregated incident data to provide threat intelligence back to NZ businesses. If your incident was caused by a vulnerability or attack technique others should be warned about, CERT NZ may issue a public advisory that helps other NZ businesses protect themselves.
Report at cert.govt.nz/report. You can report anonymously. CERT NZ does not share incident details publicly without your consent.
The Privacy Commissioner: Mandatory for Notifiable Breaches
Under the NZ Privacy Act 2020, reporting to the Privacy Commissioner is mandatory for notifiable privacy breaches — breaches that involve personal information and are reasonably likely to cause serious harm to affected individuals. The Privacy Commissioner's office should be notified as soon as practicable after you become aware the breach is notifiable. Affected individuals must also be notified.
The "serious harm" threshold includes: financial loss to individuals, reputational damage to individuals, physical harm, significant emotional distress, and loss of important documents or records. In a healthcare context, almost any breach of patient health information is likely to meet this threshold. In a business context, breaches involving financial information, employment information, or sensitive personal details typically meet it.
NZ Police: For Financial Crime
Where a cyber incident has resulted in financial fraud — payment redirection, invoice fraud, business email compromise — a report to NZ Police is appropriate. This is necessary for: insurance claims that require a crime reference number, civil recovery proceedings, and contributing to the evidence base for law enforcement action against fraud networks. File the report at police.govt.nz/use-our-services/online-reporting or at your local station.
Your Cyber Insurer: First Call for Major Incidents
If you have cyber insurance, your insurer should be notified at the same time as your IT provider — or before, depending on your policy terms. Most cyber insurance policies have notification windows (typically 24–72 hours from discovery of the incident) and preferred incident response firms. Engaging your insurer early activates their incident response support and protects your ability to claim. Remediating an incident before notifying your insurer can create disputes about coverage for the remediation costs.
Report cyber incidents to CERT NZ — the assistance is free and the reporting helps protect other NZ businesses. If personal data was breached, legal advice on Privacy Commissioner notification is worth getting early. And if your insurer offers 24/7 incident response, call them before you call anyone else.
