• Home /
• Resources and learning /
• A - Z guidance topics /
• Privacy breach resources

Resources and learning

If your agency has discovered a data breach it can be overwhelming to know where to start. The first thing you need to do is assess whether the breach is likely to cause anyone serious harm, and if so you need to NotifyUs via this website. We have a lot of guidance that will help you take steps to contain the breach and make sure that you set your systems up to avoid it happening again. 

Here are some links that you might find useful:

• We have a free online toolkit called Poupou Matatapu, which helps agencies do privacy well. This includes sections on Security and Internal Access Controls, Breach Management and Responding to requests and complaints well.
• Principle 5 – storage and security of information says that organisations must ensure there are safeguards in place that are reasonable in the circumstances to prevent loss, misuse or disclosure of personal information.
• Principle 9 – retention of personal information says that an organisation should not keep personal information for longer than it is required for the purpose it may lawfully be used. Health agencies are subject to the Health Information Privacy Code, and non-health agencies are subject to the Privacy Act even when they are collecting health information. Health agencies and non-health agencies may have different retention requirements. For example Functional Disposal Authorities for health agencies.
• Read our guidance about the Health Information Privacy Code and a factsheet on the storage, security, retention and disposal of health information.
• Section 11 of the Privacy Act means that if you send personal information to a third-party provider and that provider only uses or manages the information on your behalf, you remain responsible for what the third-party does with the personal information. Your contract with the third-party provider will help you figure out the legal relationship. We have guidance on working with third-party providers.

We have a Knowledge Base that answers many common questions. If you do not know the answer to a question searching keywords in this Knowledge Base will be a good first step. For example:

• How do I respond to a request to correct or delete information?
• Which agency reports a privacy breach?
• What security measures are appropriate?

You should seek expert legal or privacy advice if you need help interpreting your obligations.