Privacy Act 2020 — notifiable privacy breaches

An agency must notify the Privacy Commissioner as soon as practicable after becoming aware of a notifiable privacy breach — one that has caused or is likely to cause serious harm to an affected individual — and must also notify the affected individuals. There is no numeric deadline. What gives the duty teeth is s. 118: failing to notify the Commissioner without reasonable excuse is a criminal offence carrying a fine of up to NZD 10,000, which makes New Zealand one of the few regimes in this dataset where non-notification is itself an offence rather than a civil contravention. 'Agency' is defined broadly and includes overseas agencies carrying on business in New Zealand, whether or not they have a place of business there.