Privacy Act Changes
5 November 2019
Changes to the Privacy Act are currently making their way through Parliament and are expected to be passed into law before the end of the year. The changes are being made to make sure that the legislation is in line with new technology and the way that businesses now operate.
The proposed changes include:
- Mandatory reporting to the Privacy Commissioner and affected individuals of privacy breaches, where the breach has caused or is likely to cause serious harm. When considering if the breach is notifiable, consider the following:
- Is the information sensitive in nature?
- The nature of harm caused.
- Who obtained or may obtain the information as result of the breach?
- Any action taken by the agency to reduce harm.
- Whether the information is protected by security measures; and
- Any other relevant matters.
- You must also advise the Office of the Privacy Commission as soon as practicable after becoming aware of a notifiable breach either by email, phone or using their online form
- If a business receives a request for personal information, the business cannot destroy the information in order to avoid providing it.
- Where NZ businesses use overseas service providers e.g. cloud storage, the NZ business is treated as holding the personal information stored with the overseas provider, which means the NZ business remains responsible for complying with the privacy principles in respect of that information.
- Agencies will be required to take into account the vulnerability of children and young people when collecting personal information from them. In an amendment to Privacy Principle 4 (which sets out how personal information should be collected).
What you will need to do:
- Undertake training with your staff about your process to follow in the event of a serious privacy breach.
- Make sure that you and your staff are aware of how to respond to requests for personal information.
- Make sure that all personal information is stored securely and disposed securely when you have finished with it.
- If you are using an overseas based agency e.g. IT service provider for cloud computing, ask them how they are meeting NZ privacy laws. A change to the Act means that you must have reasonable grounds to believe the person overseas complies with the Privacy Act or an equivalent law safeguarding privacy.
- Appoint a Privacy Officer , this is a requirement under the Privacy Act.
- Review your Privacy Statement
- If required use the Privacy Commission on-line learning
Remember the same principles apply to your employee’s information.
Other recent articles
8 July 2025
Upcoming KiwiSaver changes
The 2025 Budget announced a range of KiwiSaver changes. If you’re an employer or a KiwiSaver member it’s important to understand how KiwiSaver works. The key changes are outlined here.
11 June 2025
What do you need to do when you receive a resignation.
An employee resigns by giving you notice. This will usually be in writing but may sometimes be done verbally. If the employee resigns verbally, you should request that they put their resignation in writing. If written notice is not provided, you should write to them and record their verbal resignation.
8 April 2025
A week in the life of HealthyPractice
So what does an average week look like for us? We review about 50-60 Individual Employment Agreements, contracts for service and letters of offer. Things we commonly adjust include: Agreement type e.g. fixed term, or casual that should be permanent part time Hours of work Trial period dates – remember the notice period can be shorter for this and we recommend 3 days to one week. Letter of offer details don’t match the IEA
Join other practices already using HealthyPractice.
Register now