Start by working out what you're protecting

Most privacy advice is a long list written for nobody in particular. Following all of it is exhausting, and people give up. Security professionals start by working out what needs protecting, from whom, and how bad it would be if it went wrong. That’s called a threat model. You can do a useful one in fifteen minutes with a pen.

Question 1: What would hurt if someone else had it?

Write down the things that would cause you real harm if the wrong person saw, changed or deleted them. Be concrete. For most people the list includes:

your email account, because it can reset every other account
your banking and anything that can move money
your home address, if anyone wishes you harm
photos and messages you’d never want shared
your identity documents and IRD number
your children’s locations and routines

Question 2: Who might want it?

There are three broad groups, and the advice is very different for each.

Strangers after money. Scammers and criminals working at scale. They want whatever they can turn into cash, from anyone. Most New Zealanders face only this group. The defences are good account security, scepticism about unexpected messages, and knowing what to do quickly when something goes wrong.

Someone who knows you. A former partner, a family member, a colleague or neighbour you’re in conflict with. This person may know your passwords, your routines, the answers to your security questions, and who your friends are. They may have had access to your phone. The defences are different and the order you do things in matters, because changes can alert them. Read the technology-facilitated abuse guide first.

Someone targeting you because of who you are or what you do. People working in courts, health, policing, journalism, politics or activism, people with a public profile, and people who’ve been in the news. The risk is often a stranger who wants to find you in person. Public records and your digital footprint matter most here. See privacy for people in higher-risk roles.

You can be in more than one group. Pick the one that worries you most and start there.

Question 3: How would they get it?

For each item from question 1, think about the likely route.

Stolen or reused passwords. NCSC figures show that millions of New Zealand account details have been exposed in breaches. You can check your email addresses on How Exposed Am I.
Tricking you. A text, call or email that creates urgency and asks you to act.
Access you gave them once. A shared password, a family phone plan, a shared cloud photo album, location sharing you set up years ago.
Public information. The rates database, the electoral roll, the Companies Register, social media, a club newsletter.

Question 4: What’s the cheapest thing that blocks the likeliest route?

This is where you choose what to do. For most people, the answer is the same three things, in this order:

Secure your email with a strong unique password and two-step verification or a passkey.
Use a password manager so every password is different.
Decide in advance that you will never act on an unexpected message asking for money, codes or logins without checking through a channel you already trust.

If someone who knows you is the concern, the cheapest effective step is usually to review recovery details and sharing settings, with a plan, from a device they haven’t touched.

If public information is the concern, the cheapest step is often a five-minute letter to your council asking it to withhold your name from the rates database, and a look at the unpublished electoral roll.

Write it down

Put your answers on one page and keep it somewhere private. Revisit it when your life changes, for example with a new job, a move, a breakup, a public role, or a child getting their first phone. The personal exposure audit is a good next step for anyone in the second or third group.

What this won’t do

A threat model is a way of choosing. It doesn’t make you safe from someone with the resources of a government, and it doesn’t replace help from Police or a family violence advocate when someone is actively harming you. If that’s your situation, go to Get help now.