A cyber incident may also trigger urgent privacy obligations
Source: Office of the Privacy Commissioner
Published: 5 October 2026
NZSAE Resource: Cyber Incident and Privacy Breach Checklist for Associations
A legal practice discovered unauthorised access to an email account containing sensitive client information but initially treated it only as a cybersecurity matter. It took six months to recognise and report the notifiable privacy breach.
The Commissioner emphasises that:
- Organisations must assess whether a cyber incident involving personal information could cause serious harm.
- Notifiable breaches must be reported to the Commissioner and affected people as soon as practicable.
- The Commissioner expects notification within 72 hours once an organisation determines that a breach is notifiable.
- Knowledge held by staff or contracted providers is treated as knowledge held by the organisation.
- Supplier contracts should require providers to report privacy incidents promptly.
Why it matters: An association’s IT provider may contain the technical problem without anyone asking whether member, employee or delegate information was accessed. Cyber response and privacy response cannot operate as separate processes. privacy.org.nz
Practical action: Check whether the organisation’s incident-response plan assigns someone to make the privacy assessment, gives the privacy officer immediate access to technical findings and imposes reporting obligations on CRM, cloud, payroll and event-platform providers.