Faraday blog

Why Faraday's privacy know-how is now free

2026-10-19T04:00:00.000Z

Faraday is a privacy foundry founded in Auckland. We help people and organisations who are at risk because of who they are, what they do, or the information they handle. We help people take back control of their online lives, sometimes in advance and often in a crisis. We help organisations turn privacy law into habits their staff actually follow.

Most of that work follows a method, and a method can be written down. So we’ve written it down and given it away, because we want to democratise this work, to keep people safe and secure, without the hefty bill for the basics, or even detailed work that moves the needle. If your situation needs a person, you can still get in touch.

What’s here

Guides for people: what’s public about you in New Zealand and how to reduce it, account security, scams, harassment, intimate image abuse, technology-facilitated abuse, identity theft, and your rights under the Privacy Act.
Guides for organisations: the Privacy Act in plain language, a 90-day programme for a small organisation, breach response, the new indirect collection rule, the biometrics code, AI, Māori data, and data governance.
Tools that run in your browser and send nothing anywhere, including a statutory deadline calculator, request letters, a breach assessment record, an indirect collection check, a personal exposure audit and a privacy self-check.
Templates: privacy statements, collection notices, a privacy impact assessment, a breach response plan and register, an inventory, a retention schedule, policies, and a digital safety plan.

Everything is licensed for reuse. The content is CC BY 4.0 and the code is MIT. Put our breach plan in your staff handbook. Run the exposure audit in a workshop. Fork the whole site.

Why give it away

Privacy advice in New Zealand is often sold as if it were secret. It isn’t. The law is public. The Privacy Commissioner publishes good guidance, including Poupou Matatapu, which sets out what doing privacy well looks like, and explicitly invites organisations to build their own checklists and templates from it. Much of what consultancies charge for is applying that public material to ordinary situations. That method can be written down, so we’ve written it down.

The need is real. Organisations reported 1,093 privacy breaches to the Commissioner in 2024/25. The National Cyber Security Centre received 1,129 incident reports in just April to June 2026. Netsafe said in June that it was receiving more harmful digital communications complaints than at any time in its history. Most of the people and organisations behind those numbers will never hire a consultant.

What we won’t pretend

Free guidance has limits, and we say so. If you’re facing a complex legal situation, talk to a lawyer. If you’ve been hit by ransomware, or you’re facing a cyber challenge you don’t feel comfortable navigating yourself, call the NCSC and get incident response or forensic help. If someone is hurting you, call 111, Women’s Refuge or Shine. Our free versus paid page sets out where professional help is worth paying for.

How we keep it accurate

Every legal claim on this site links to its source, and every source carries the date we last checked it. You can see how it’s built in the source code.

When the law changes, we’ll update the guidance and say what changed. If you spot an error, tell us. If you’re a privacy practitioner, lawyer or advocate, we’d especially welcome your review.

Ngā mihi to everyone who trusted Faraday with their hardest moments online. This is for you, and for anyone in Aotearoa who needs it.

Enrol by 25 October without putting your address on the roll

2026-10-19T03:30:00.000Z

The general election is on Saturday 7 November 2026, and enrolment closes at midnight on Sunday 25 October. That’s earlier than in past elections, because you can no longer enrol on election day.

For most people, enrolling is a two-minute job at vote.nz. But the printed electoral roll lists your name, address and occupation, and it can be inspected publicly. If someone is looking for you, that matters.

You don’t have to choose between voting and staying safe. Section 115 of the Electoral Act lets the Electoral Commission put you on the unpublished roll if publishing your details would prejudice your personal safety or your family’s.

Who it’s for

People whose safety could be put at risk if their address were published. That commonly includes people who have experienced family violence, people with a protection order, and people facing threats because of their work or circumstances. Each application is considered on its merits.

What you need

The Electoral Commission asks for information that shows why you need to be on the unpublished roll. You don’t need every type, but examples include:

a copy of a protection order
a letter from Police or a Corrections officer explaining why publishing your details could put you or your family at risk
a letter from a support agency, such as a family violence service

If you’re not enrolled yet, or your address has changed, you also need to complete an enrolment form.

How to apply

Download the application form from vote.nz/unpublished, then email it to unpublished.roll@elections.govt.nz or post it to the Electoral Commission, PO Box 190, Wellington 6140.
Or call 0800 36 76 56 and ask for forms to be posted.

Apply as early as you can, because processing can take time. Writ Day was 4 October, so anyone who enrols from now on casts a special vote anyway. Printed rolls are also made available for public inspection after elections, so getting onto the unpublished roll now still keeps your address off those.

How voting works for you

Your details won’t appear on the printed roll at voting places.
You’ll cast a special vote. Tell the voting place staff you’re on the unpublished roll.
You won’t be able to download voting papers if you’re overseas.
For local elections, you’ll need to ask your council’s electoral officer to send you voting papers, because they won’t be sent automatically.
You stay on the unpublished roll until you ask to come off it, so tell the Commission when your details change.

Already enrolled at an address you’d rather keep private?

Apply anyway. Being on the unpublished roll keeps your details out of printed rolls produced from now on.

The rest of your public footprint

The electoral roll is one of three main public registers with home addresses. The others are your council’s rates database, where anyone can ask for their name to be withheld, and the Companies Register for directors, which changes on 18 November. Our guide to getting your address off public registers covers all three, and the personal exposure audit goes further.

Enrol by 25 October. Your vote is yours, and so is your address.

Pay for judgement, not for templates

2026-10-19T03:00:00.000Z

We looked at what privacy consultancies, accounting firms, cyber security firms and law firms in New Zealand offer. The menus are remarkably similar. Most offer privacy policy drafting, privacy impact assessments, gap analyses and audits, maturity assessments, training, breach response planning, supplier risk reviews, and outsourced privacy officers.

Some of that work needs years of experience. Most of the rest needs someone who understands the organisation, a clear method and a good template. The organisation already has the first. We’ve published the other two.

What you can now do yourself

What’s usually sold	The free version
Privacy policy drafting	Our privacy statement template and collection notices, plus the Commissioner’s own generator
Gap analysis or maturity assessment	Our privacy self-check, organised by the Commissioner’s Poupou Matatapu
Privacy impact assessment	Our PIA template, with a threshold check and principle-by-principle assessment
Breach response planning	Our breach response plan, register and assessment record
Supplier privacy review	Our supplier questionnaire and contract checklist
Staff training	Our 30-minute induction, and the Commissioner’s free e-learning
Data mapping	Our personal information inventory and interview guide
Personal exposure review	Our personal exposure audit

What’s still worth paying for

Legal advice and representation. If you’re facing a complaint the Commissioner is investigating, Tribunal proceedings, or a dispute over whether a disclosure was lawful, you want a lawyer.

Incident response. After a cyber attack you need forensic investigators who can work out what was taken, preserve evidence and get you running safely. Call the NCSC and your insurer first.

High-risk assessments. A PIA for facial recognition, large-scale data matching, AI decisions about people, or a national health system deserves an experienced reviewer, even if you write the first draft.

Independent assurance. Sometimes you need someone outside the organisation to say it’s sound, for a board, a funder or a client.

Time. If nobody in your organisation has the hours, paying someone can be the right call. You’ll get far more for your money if you’ve done the inventory and self-check first, because you’ll be paying for judgement rather than discovery.

Questions to ask before you hire anyone

Will you use our inventory and self-check results, or start from scratch?
Who will actually do the work, and what’s their New Zealand privacy experience?
What will we own at the end? Can we update the documents ourselves?
Is this a fixed price?
How will you handle our information while you work on it?

A good adviser will be glad you’ve done the groundwork. Our full comparison is on the free versus paid page.

A short biometrics audit for every workplace, now the grace period is over

2026-10-19T01:00:00.000Z

The Biometric Processing Privacy Code came into force on 3 November 2025 for new biometric processing. Organisations already using biometrics had a nine-month transition. That ended on 3 August 2026. Every biometric system in New Zealand, old or new, now has to comply.

Most organisations don’t think of themselves as using biometrics. Then someone mentions the fingerprint scanner at the staff entrance.

Where biometrics hide

Fingerprint or face timeclocks and door access
Security cameras with face recognition switched on, sometimes by default
Identity verification apps that compare a selfie with an ID document during onboarding
Voice verification on phone lines
Online exam or interview software that analyses faces
Visitor management systems that capture photos and match them

The ten-minute audit

For each system you find, answer four questions. If you can’t answer “yes” to all four with evidence, you have work to do.

Have we documented why it’s necessary and proportionate? The code requires an assessment weighing the privacy risks against the benefits. For a timeclock, ask honestly whether a card or PIN would do the job. If so, biometrics will be hard to justify.
Is there an alternative for people who don’t want to use it?
Do people get clear notice before or when their biometric information is collected?
Do we know where the templates are stored, who can access them, and when they’re deleted? Including when staff leave.

If you can’t justify it

Switch it off, delete the stored templates, confirm deletion with the vendor in writing, and record the decision. That’s a perfectly good outcome. Many organisations will find the old system was solving a problem a cheaper, less intrusive tool solves just as well.

If you can justify it

Write it down. Our biometric proportionality worksheet gives you a structure, and our guide to the code explains what each part requires. Then fix notices, contracts and retention.

A red flag to watch for

The code restricts using biometrics to infer things like emotions, personality, mood or health, and to categorise people by sensitive characteristics. If a vendor is selling “sentiment analysis” or demographic insights from camera footage, read the code carefully before agreeing to anything.

IPP 3A six months on, and the collections we'd check first

2026-10-19T00:00:00.000Z

Since 1 May 2026, organisations that collect personal information about someone from anyone other than that person must take reasonable steps to make sure the person knows, unless an exception applies. It’s information privacy principle 3A, and it applies to information collected from 1 May onwards.

Plenty of organisations updated their privacy statement in April and moved on. A statement alone may not be enough. If you haven’t checked how people actually find out about each indirect collection, start with these.

1. Reference checks

You collect a referee’s views about an applicant. That’s indirect collection. To fix it, say in your job application form that you’ll contact the referees the applicant nominates, why, and who will see what they say. That tells the applicant in advance.

2. Credit and identity checks

Information from credit reporters or verification services is indirect collection. The Commissioner’s own example has a lender naming the credit reporters it collects from, and the purpose, in the application form, then keeping evidence the client saw it.

3. Referrals from partners

If another organisation refers people to you, you’re collecting from that organisation. Either the referrer tells the person about you (and you can show it, ideally because your agreement requires it), or you tell them when you first make contact.

4. Children’s information from parents

The Commissioner treats this as indirect collection. Address your notice to the parent, so they can explain it to their child in a way that suits their age.

5. People named by your customers

Emergency contacts, additional drivers, household members, beneficiaries. For emergency contacts, the Commissioner gives an example where the “would not prejudice their interests” exception is likely to apply. For others, especially where you’ll use the information to make decisions about that person, you probably need to notify.

6. Bought or shared lists

If you receive a marketing list, you’re an indirect collector, and so is anyone further down the chain. The Commissioner’s example allows a short delay so the notice can arrive with your first campaign message, but not skipping it.

7. Online research

Information about people gathered from the web or social media. If it’s genuinely public, such as an open website or public profile, the publicly available exception may apply. A private account you can see because you follow it isn’t public.

How to check yourself

Use our indirect collection check for each type of collection. It asks whether an exception applies, explains what evidence you’d need, and drafts a notice and a decision record. Keep the records together. If the Privacy Commissioner ever asks how you comply with IPP 3A, that file is the answer.

The Ministry of Justice has said one aim of the change is to support New Zealand keeping its adequacy status with the European Union. For businesses trading with Europe, getting this right is about more than domestic compliance.

What the Manage My Health findings mean for anyone holding sensitive data

2026-10-18T23:00:00.000Z

In December 2025, attackers stole health information from the Manage My Health patient portal, used by general practices across the country. Manage My Health notified the Privacy Commissioner on 1 January 2026. Media reported that the records of nearly 100,000 patients were taken, making it one of the most damaging health data breaches in New Zealand’s history.

The Commissioner opened a formal inquiry in January and released the findings of its first phase in late May 2026. Phase one looked at what caused the breach and who was accountable. Phase two, still under way, looks at the impact, including the quality of communications and whether the breach affected some groups disproportionately, particularly Northland Māori.

What the Commissioner found

The breach wasn’t the result of a single failure. The Commissioner found Manage My Health failed to have reasonable security safeguards in place, breaching rule 5 of the Health Information Privacy Code (the health equivalent of IPP 5), and said it intends to issue a compliance notice.
Health NZ also breached rule 5. The Commissioner found serious problems with the quality of privacy risk assessments in Health NZ’s involvement, while noting things improved in later stages and the findings are largely historic. It also intends to issue Health NZ with a compliance notice.
Warnings went unheeded. Reporting on the findings said Manage My Health had been warned about security flaws that contributed to the breach.
Notifications fell short. Patient notifications were described as often confused, overly optimistic and inaccurate.

Five lessons for everyone else

1. Treat security findings as debts with due dates. If a penetration test, audit or staff member tells you about a weakness, record it, give it an owner and a deadline, and report progress to leadership until it’s fixed. A list of known, unfixed issues is the worst document to have in your files after a breach.

2. Expect layered failures. Breaches rarely come from one mistake. They come from several small gaps lining up, such as an unpatched system, weak monitoring and one account without multi-factor authentication. Defence in depth means any single gap shouldn’t be enough.

3. Commissioning a supplier doesn’t hand over your responsibility. Health NZ wasn’t running the portal, and it was still found in breach because of the quality of its own risk assessment. If you contract out a system that holds sensitive information, the regulator will look at what you assessed, what you required in the contract, and how you checked. Our supplier questionnaire is a starting point.

4. Write breach notices people can act on. Say exactly what was taken, what you know and don’t know, and what people should do. Don’t promise there’s no risk. Don’t say there’s “no evidence of misuse” unless you’ve looked properly. People forgive bad news far more readily than spin that turns out to be wrong. Our breach response plan includes a notice checklist.

5. Think about who is hit hardest. The Commissioner is examining whether one community bore more of the harm. When you assess a breach, ask how it lands for the most vulnerable people affected, and whether a particular community needs a different response.

The wider signal

This was the Commissioner using its inquiry and compliance notice powers on a high-profile breach, and finding fault with a large public body as well as a private supplier. Organisations that hold sensitive information should expect the same scrutiny of their own security and supplier arrangements.

A good first step is our privacy self-check, which covers security, breach readiness and risk assessment against the Commissioner’s own Poupou Matatapu.

Directors can take their home address off the Companies Register from 18 November

2026-10-18T22:00:00.000Z

Every New Zealand company director has had to publish their home address on the Companies Register, where anyone can search it for free. Parliament heard evidence of directors being found and approached at home by people who got their address that way, including women directors who were stalked after their address was found there, and mental health practitioners concerned that clients could find them at home.

From 18 November 2026, that changes. The Companies (Address Information) Amendment Act 2025 comes into force, along with regulations setting out what an application must include.

Who can apply

Current directors and people about to become directors. You apply to the Registrar of Companies to replace your residential address on the public register with an alternative address.

What you’ll need

A statutory declaration that public availability of your residential address is likely to result in physical or mental harm to you or to someone who lives with you. A statutory declaration is a formal statement made before an authorised witness, such as a lawyer, Justice of the Peace or court registrar.
An alternative address that is:
- a physical address in New Zealand where documents can be served on you
- not the company’s registered office or address for service
- not a PO Box, postal centre or document exchange
- if it’s at an accountant’s, lawyer’s or other person’s office, identified as such in the application
Any fee the regulations set.

You’ll still give your residential address to the Registrar. It just won’t be public.

What it doesn’t fix

Past directorships. You can’t replace an address linked to a company you’ve already left, or a company that’s been removed from the register.
Shareholders, mostly. The protection extends to a shareholder only if they’re the applying director, or live with the director and consent.
Copies elsewhere. Data already scraped by business directories and search engines won’t change automatically.
Other registers. Your name and address may still appear on the rates database, the electoral roll, land titles and in other records.

What to do before 18 November

Search the Companies Register for your own name. Note every current and past company, and which addresses appear, including in older documents.
Arrange an alternative address. Ask your accountant or lawyer whether you can use their office, and how they’ll handle documents served on you there.
Prepare your statutory declaration, so you can apply on day one.
Talk to co-directors and household members who are shareholders.
Deal with the other registers now: write to your council asking it to withhold your name from the rates database, and consider the unpublished electoral roll if you have safety concerns. See getting your address off public registers.

Is it worth it if I’m not at risk?

The test is that publication is likely to result in harm. That’s a real threshold, and the declaration is a formal legal document, so don’t sign it unless it’s true for you. Directors of businesses that deal with distressed or angry members of the public, people in public-facing roles, and anyone with a history of threats are the people this was designed for.

The Government’s wider review of the Companies Act may change the default for everyone. Until then, this is the route.

The five-minute letter that takes your name off your council's rates database

2026-10-18T21:00:00.000Z

Type almost any street address into a New Zealand council’s property search and you can often see who owns it and where their rates bills go. It’s called the rating information database, and councils are required by the Local Government (Rating) Act 2002 to make owners’ names and postal addresses available for public inspection.

There’s a good reason for it. People sometimes need to contact a property owner, for example about a boundary fence or a resource consent. But it also means anyone who knows your address can learn your full name, and anyone who knows your name and suburb can often work out your address.

Your right to opt out

Section 28C of the Act gives every owner the right to ask the council to withhold their name, their postal address, or both, from the public database. Three things make this one of the easiest privacy wins in the country:

You don’t need a reason. Unlike the unpublished electoral roll, there’s no safety test.
It’s free.
Councils must tell owners about the right each year, usually in small print on the rates notice, which is why so few people notice it.

How to do it

Find your council’s form. Search your council’s website for “withhold name rating information database” or “rates suppression”. Dunedin City Council, Otago Regional Council, Gisborne District Council and Nelson City Council are among those with forms online. If you can’t find one, a letter or email works, because any written request meets the Act.
Include your name, the property address, the valuation or rates assessment number (on your rates notice), and whether you want your name, postal address, or both withheld.
Send it to the council’s rates team.
Check a few weeks later by searching your property on the council website.

If your regional council issues separate rates, send the request to it as well, unless your district council handles both.

A letter you can copy

To the rates team, [council name]

Under section 28C of the Local Government (Rating) Act 2002, I ask the council to withhold my name and postal address from the rating information database for the following property:

Property address: [address] Valuation or assessment number: [number] Owner name: [your name]

Please confirm when this has been done.

[Your name] [Date]

What it does and doesn’t do

At several councils, one owner’s request removes all owners’ details for that property. Check with your co-owners.
It doesn’t change your record of title, which names the owners and can be bought from Land Information New Zealand.
It doesn’t remove information other websites have already copied.
Your property’s valuation and rates remain public, because those relate to the property itself.

Even with those limits, it removes the easiest free lookup of who lives where. If you’d like to go further, the personal exposure audit covers the electoral roll, the Companies Register and the rest of your footprint.