← Business Compliance Health Check
Practical starting points for New Zealand businesses to protect information, understand privacy responsibilities and use workplace AI more carefully.
Map what personal information you hold, why you need it, who can access it, and how individuals can request access or correction. The Privacy Act 2020 applies to agencies, subject to exceptions and applicable codes.
Action: Assign responsibility for privacy and check your privacy notice and collection practices.
Official NZ guidance →When collecting personal information from another source, check the lawful basis and whether you must take reasonable steps to notify the individual. Exceptions apply. IPP 3A took effect on 1 May 2026.
Action: Review referral, recruitment, supplier and third-party data flows; document how notification is handled.
Official NZ guidance →A breach that has caused or is likely to cause serious harm is notifiable to the Privacy Commissioner and affected people, subject to statutory exceptions. Notify as soon as practicable; the Commissioner's 72-hour expectation is guidance, not a fixed statutory deadline.
Action: Prepare an escalation contact, containment steps and a breach-assessment procedure. Never paste personal breach details into public tools.
Official NZ guidance →Enable multifactor authentication, use unique credentials, review administrator privileges and promptly remove access when people leave.
Action: Inventory critical accounts and confirm MFA and recovery methods.
Official NZ guidance →Maintain recoverable backups, apply security updates and assess what service providers can access. Test restoration and document who owns recovery decisions.
Action: Choose one critical system and conduct a controlled restore test.
Official NZ guidance →Train staff to recognise suspicious messages and verify unusual payment or access requests using a trusted second channel. Have an incident contact and response plan.
Action: Run a short team briefing and practise a safe reporting workflow.
Official NZ guidance →Avoid entering customer, employee, confidential or sensitive business information into AI tools without appropriate authority, security controls and privacy assessment. Check outputs before relying on them.
Action: Document permitted AI uses, human review, information restrictions and supplier checks.
Official NZ guidance →Start with our business health check and small-business compliance checklist. These are planning aids, not security assessments. For an actual privacy breach, use the Privacy Commissioner's NotifyUs guidance promptly.
Source review: 10 November 2026. New Zealand Privacy Act 2020, Office of the Privacy Commissioner, and National Cyber Security Centre public guidance. No paid standards reviewed or reproduced.