Responding to a privacy breach in the first 72 hours

Organisations reported 1,093 privacy breaches to the Privacy Commissioner in 2024/25, up from 864 the year before. The Commissioner has reported that human error causes most breaches, with email mistakes and unauthorised sharing the most common types. Malicious attacks are a large and growing share of serious breaches, and they tend to affect far more people.

The Privacy Act requires you to notify the Commissioner and affected people about a notifiable breach as soon as practicable. The Commissioner expects notification within 72 hours of you becoming aware. That’s not long, so the first hours matter.

What counts as a breach

Under section 112 of the Privacy Act, a privacy breach is unauthorised or accidental access to, or disclosure, alteration, loss or destruction of, personal information. It also includes anything that stops you accessing the information, temporarily or permanently. Ransomware that only encrypts your files is still a breach.

A breach is notifiable if it’s reasonable to believe it has caused serious harm to someone, or is likely to.

Hour 0 to 4: contain and preserve

Stop it continuing. Recall the email if possible. Disable the compromised account. Revoke the shared link. Disconnect the infected machine from the network (don’t switch it off, as that can destroy evidence).
Ask recipients to delete information sent to them by mistake, and to confirm in writing that they have, and that they haven’t shared it.
Preserve evidence. Logs, the email, screenshots, who knew what and when.
For a cyber attack, call the National Cyber Security Centre on 0800 114 115 and, if you have one, your cyber insurer, before you engage your own IT provider to clean up. Insurers often require their own responders.
Start a log of every action and decision with the time. You’ll need it.

Hour 4 to 24: assess

Work through the factors section 113 says you must consider:

What have you done to reduce the risk of harm?
Is the information sensitive?
What kind of harm could result, to the most vulnerable person affected?
Who has obtained it, or could, if you know?
Was it protected by a security measure, such as encryption?
Anything else relevant.

Our breach assessment record walks through these and produces a written record. Work out how many people are affected and what information about each of them was involved. You need this for the notification.

If you can’t tell yet, don’t wait for certainty. Notify on what you know and update the Commissioner later.

Hour 24 to 72: notify

The Commissioner. Use the NotifyUs tool on the Commissioner’s website. You can update your notification as you learn more.

Affected people. Tell them as soon as practicable. Your notice should say, in plain language:

what happened and when
what information about them was involved
what you’ve done and are doing about it
what they can do to protect themselves, specifically (for example, “your driver licence number was exposed; here’s how to get a replacement and we’ll reimburse the cost”)
how to contact you with questions
that they can complain to the Privacy Commissioner

If it’s not reasonably practicable to tell everyone individually, the Act allows a public notice instead. There are also limited exceptions to notifying affected people, for example where notifying would endanger someone’s safety. Record your reasons if you rely on one.

The Manage My Health lesson. In its May 2026 inquiry findings, the Commissioner described patient notifications after that breach as often confused, overly optimistic and inaccurate. Write notices that are specific and honest. Don’t say there is “no evidence of misuse” if you haven’t looked, and don’t minimise.

Who else to tell

Your insurer, early.
Your board or leadership.
Your bank, if financial information was involved.
Police, if there’s a crime such as theft or extortion.
Any regulator specific to your sector.
Other organisations whose data was affected, such as a client whose records you held.

Don’t pay for silence

If criminals demand payment to delete stolen data, get advice from the NCSC and your insurer. Paying doesn’t guarantee deletion, and it doesn’t remove your obligation to notify.

Afterwards

Within a few weeks, review what went wrong and what you’ll change. Record it in your breach register with the decision, the notification dates and the changes made. The Commissioner’s Poupou Matatapu expects you to learn from breaches, and a register showing that you did is your best evidence.

Use our breach response plan to put names next to each of these steps before you need them.