Faraday
Get help now

Breach assessment record

Work through the serious-harm factors in section 113 of the Privacy Act and leave with a written record of your decision.

Your data
Runs in your browser. Nothing you type is sent anywhere.
Sources
8 cited

If this is happening now, contain it first. Disconnect affected systems, revoke access, ask recipients to delete, and preserve logs. For a cyber attack, call the National Cyber Security Centre on 0800 114 115. Then come back and record your assessment.

The basics
What happened to the information? (s 112)

Tick everything that applies.

Is any of it sensitive? (s 113(b))
What harm could realistically follow? (s 113(c))

Think about the most vulnerable person affected.

Who has it, or might? (s 113(d))
Was it protected? (s 113(e))
What have you done to reduce the risk? (s 113(a))

How to read the result

The Privacy Act asks whether it is reasonable to believe the breach has caused serious harm, or is likely to. It does not define serious harm with a formula, and neither do we. This aid weighs the s 113 factors and applies three rules that no points total should override. A criminal holding unprotected data, the location of someone at risk reaching the wrong person, and exposed credentials are each treated as notifiable.

Not notifying a notifiable breach is an offence with a fine of up to $10,000. Notifying something that turns out to be minor costs you an email. When you're unsure, notify.

Report to the Commissioner through NotifyUs. Use our breach response plan and breach register to keep the paper trail.

Sources

  1. Privacy Act 2020, s 112 (meaning of privacy breach and notifiable privacy breach)NZLII. Checked 19 October 2026.
  2. Privacy Act 2020, s 113 (assessing likely harm)NZLII. Checked 19 October 2026.
  3. Privacy Act 2020, s 114 (notifying the Commissioner)NZLII. Checked 19 October 2026.
  4. Privacy Act 2020, s 115 (notifying affected individuals or giving public notice)NZLII. Checked 19 October 2026.
  5. Privacy Act 2020, s 116 (exceptions to notifying affected individuals)NZLII. Checked 19 October 2026.
  6. Privacy Act 2020, s 118 (offence of failing to notify the Commissioner)NZLII. Checked 19 October 2026.
  7. Sorting out privacy breaches (including NotifyUs)Office of the Privacy Commissioner. Checked 19 October 2026.
  8. Breach management (Poupou Matatapu)Office of the Privacy Commissioner. Checked 19 October 2026.

Something wrong or out of date? Tell us or edit this page on GitHub. General information, not legal advice.