The NZ Privacy Act 2020 introduced mandatory breach notification obligations and significantly strengthened requirements around how businesses collect, store, and protect personal information. Here's what it actually requires from your IT security — in plain language.
The Privacy Act 2020 replaced the 1993 Act with a more stringent framework — one that includes mandatory breach notification for the first time, extraterritorial application to overseas businesses that hold information about New Zealanders, and the ability for the Privacy Commissioner to take enforcement action including issuing compliance notices and referring serious cases for prosecution.
Privacy Principle 5: Storage and Security
Privacy Principle 5 requires that personal information is protected "by such security safeguards as it is reasonable in the circumstances to take against loss, access, use, modification, or disclosure of personal information." The phrase "reasonable in the circumstances" is interpreted by the Privacy Commissioner with reference to: the sensitivity of the information (health data requires stronger safeguards than mailing addresses), the scale of the data held, and the current state of available security technology.
In 2025, "reasonable security safeguards" for a business holding health information means: encryption at rest and in transit, MFA on any system accessible via the internet, access controls limiting staff access to information they need for their role, and a process for identifying and responding to security incidents. A business holding health information with no MFA, no encryption, and no incident response process is very likely in breach of Principle 5.
The Mandatory Breach Notification Obligation
Section 113 of the Privacy Act 2020 requires organisations to notify the Privacy Commissioner and affected individuals as soon as practicable after becoming aware of a notifiable privacy breach. A notifiable breach is one that has caused serious harm or is reasonably likely to cause serious harm to affected individuals.
Serious harm includes: physical harm, significant financial harm, significant reputational damage to an individual, or significant humiliation or distress. For health information, the Privacy Commissioner has taken the view that disclosure of health information to unauthorised parties is generally likely to cause serious harm — meaning most health data breaches are notifiable.
The Consequences of Non-Compliance
The Privacy Commissioner can issue compliance notices requiring remediation of privacy practices. Failure to comply with a compliance notice is a criminal offence. The Commissioner can also authorise the Director of Human Rights Proceedings to take complaints to the Human Rights Review Tribunal, which can award damages to affected individuals. For systemic privacy failures — a business that repeatedly fails to protect personal information despite being aware of the risks — the consequences can be significant.
What Compliance Actually Looks Like
For most NZ SMBs, Privacy Act compliance in a cyber security context means: a data inventory identifying what personal information you hold and where, appropriate security controls commensurate with the sensitivity of that information (health and financial data requires the highest standard), a documented breach response process including how you'd identify a breach, assess it for notifiability, and notify if required, and a regular review of access controls to ensure only staff with a need can access personal information.
The Privacy Act 2020 isn't just a privacy regulation — it's a de facto security regulation. The obligation to protect personal information with reasonable security safeguards, and to notify when breaches occur, makes basic cyber security hygiene a legal requirement, not just good practice.
