New ZealandPrivacy Act 2020, Notifiable Privacy Breaches
Privacy Act 2020 (NZ), No 31, ss. 112-118
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23223.htmlIn force since .
A breach notification rule binding public and private bodies.
- Enforcement body
- Office of the Privacy Commissioner
- Audit expectation
- none
What it requires
- Notify the Privacy Commissioner as soon as practicable after becoming aware that a notifiable privacy breach, one reasonably believed to have caused or be likely to cause serious harm, has occurred.
- Notify each affected individual, or give public notice if individual notice is not reasonably practicable, as soon as practicable after becoming aware of a notifiable privacy breach, unless a statutory exception or permitted delay applies.
- Failing to notify the Commissioner of a notifiable privacy breach without reasonable excuse is an offence carrying a fine of up to $10,000.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Under s. 118(1), an agency that, without reasonable excuse, fails to notify the Commissioner of a notifiable privacy breach under s. 114 commits an offence and is liable on conviction to a fine not exceeding $10,000.
Penalty structure
Fine on conviction for failing to notify the Commissioner of a notifiable privacy breach without reasonable excuse, under s. 118(1).
- Rule
- Fixed only
- As of
- Currency
- NZD
- Fixed cap
- 10,000
What it makes you log
Logging duty
Sections 114 and 115 require an agency to notify the Commissioner, and the affected individual or the public, of a notifiable privacy breach, section 117 sets what the notice must contain (including the steps taken and the reasons for any exception or delay) and section 118 makes failure to notify the Commissioner an offence. This is a duty to notify with no register of breaches kept and no record the Commissioner may inspect, so it states no log or record duty. The sections cited state no territorial clause.
- Kind
- None
- As of
What this law does
An agency must notify the Privacy Commissioner as soon as practicable after becoming aware that a notifiable privacy breach, one reasonably believed to have caused serious harm to an affected individual or to be likely to, has occurred. It must also notify each affected individual, or give public notice where individual notice is not reasonably practicable, unless a section 116 exception applies or a permitted delay is in effect.
An agency that, without reasonable excuse, fails to notify the Commissioner commits an offence carrying a fine of up to $10,000.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .