NotifyUs is for organisations and businesses to work out if privacy breaches are notifiable and report them to us.

If you're an organisation and have a privacy breach that is likely to cause anyone serious harm, you are legally required to notify us and any affected persons as soon as you are practicably able to. 

As a guide, our expectation is that a breach notification should be made to our Office no later than 72 hours after agencies are aware of a notifiable privacy breach.

Click the button below to help you determine whether your breach is notifiable or not.

Please take care when you tell us about your privacy breach that you're not also sharing people's personal information. We can help you without knowing that detail. If you're unsure then ask us before you share.

Please use only NotifyUs to report breaches so we can manage our workflow and get to your notification ASAP. You can attach documents in the NotifyUs tool. Do not email us your documents.


Do I need to notify?

If you have already determined that a privacy breach at your organisation is notifiable, or wish to notify us in any case, click on the 'Report a breach' button below to be taken to NotifyUs. 

See a checklist of what information is required here.

Please note: NotifyUs works best with up-to-date internet browsers (e.g. Chrome, Firefox and Edge). We recommend not using legacy browsers with it (e.g. Internet Explorer and legacy Edge).

Report a breach

If you need to update a privacy breach report you previously submitted to us, you can:

Email your update to: notifyus@privacy.org.nz

Or use this form:

Update a breach