ShareAndGoShareAndGo

Privacy

What New Zealand boards should be asking about privacy in 2026.

Privacy used to be filed under operations. A breach was something the IT team dealt with and the board heard about afterwards, if at all. That has changed. Customers, staff and investors now expect directors to know how the business handles personal information, and the Privacy Act sets out obligations that land on the organisation as a whole.

This article sets out what the Office of the Privacy Commissioner says about three areas a board should understand, and the questions directors can reasonably ask management. It explains published guidance. It is not advice about your organisation's obligations, which your own advisers should confirm.

Every organisation needs a privacy officer

The Privacy Commissioner's guidance is clear that every agency covered by the Privacy Act is required to have a privacy officer. An agency here means almost any business or organisation, not just a government department. The Commissioner describes the role as ensuring the agency meets its obligations under the Act, dealing with requests from people to see or correct their personal information, and working with the Commissioner during the investigation of complaints.

For a board, the useful questions are simple. Who is our privacy officer? Do they have the time, authority and access to do the job? When did they last report to us, and what did they say? In a small business the privacy officer may be the owner or the office manager. That can work well, as long as someone has actually been given the role rather than assuming it belongs to someone else.

Breach notification: the clock that matters

Since the Privacy Act took effect in December 2020, organisations have had to notify the Privacy Commissioner and affected people about a notifiable privacy breach. The Commissioner's guidance describes a notifiable breach as one where personal information has been accessed, disclosed, altered, lost or destroyed without authorisation, including a temporary loss of access, and it is reasonable to believe an affected person has suffered or is likely to suffer serious harm as a result. Its examples of serious harm include physical harm or intimidation, financial fraud, family violence, and psychological or emotional harm.

Timing is where organisations stumble. The Commissioner said in May 2024 that its expectation is notification within 72 hours of becoming aware that a breach is notifiable, while noting that this timeframe is a guide intended to prompt quick notification. That is a short window if nobody knows who decides, who drafts the notice or how to work out which records were involved.

What a board can ask

  • If we found a breach on a Friday afternoon, who would decide whether it is notifiable, and how would they reach that decision?
  • Could we tell, quickly, which documents and which people's information were exposed?
  • When did we last rehearse our response, and what did we learn?
  • Which suppliers hold our personal information, and what do their contracts say about telling us of a breach?

The second question is where document practices make a real difference. If confidential files have been emailed around as attachments, working out what was exposed means searching inboxes and guessing. If they were shared through a data room, there is a record of exactly who opened which document and when.

Indirect collection: the principle that began in May 2026

The Privacy Act now includes information privacy principle 3A, which the Commissioner says came into force on 1 May 2026. It applies when an organisation collects personal information about someone from a source other than that person. In those cases the organisation must take reasonable steps, unless an exception applies, to make sure the person knows certain things: that the information has been collected, why, who it is intended for, the name and address of the agency collecting and holding it, the law involved if the collection is authorised or required by law, and their rights to see and correct it.

The Commissioner's guidance says the principle applies to information collected indirectly from 1 May 2026, not before. Boards should ask whether the business routinely receives personal information from third parties, such as referrals, background checks, purchased lists or a counterparty's records in a deal, and whether management has worked through what IPP 3A means for those flows.

How good document practice supports the board

Directors do not need to understand encryption or access control in detail. They do need confidence that management can answer three questions at short notice: who has access to our most sensitive documents, what have they done with them, and how fast can we shut that access off.

A virtual data room such as ShareAndGo gives management straightforward answers. Access is by invitation to a named email address, confirmed with a six-digit code. Groups see only the folders they are allowed to see. Invitations can carry an end date and can be revoked at any time. Every view, upload, download, invitation and change is recorded in an audit log whose entries are chained, so an alteration shows when the log is checked, and the log exports as a CSV for the board pack.

Board papers themselves are often among the most sensitive documents a business produces. Sharing them through a room with view-only access and watermarks naming each director is a practical way to keep them where they belong.

Questions people ask

Does every New Zealand business need a privacy officer?
The Privacy Commissioner's guidance says every agency covered by the Privacy Act is required to have one. In a small business it can be an existing staff member or someone outside the business who knows it well.
How quickly should a notifiable breach be reported?
The law says as soon as practicable. The Privacy Commissioner said in May 2024 that it expects notification within 72 hours of an organisation becoming aware a breach is notifiable, as a guide.
What is IPP 3A?
A privacy principle that came into force on 1 May 2026. It covers personal information collected from someone other than the person it is about, and requires reasonable steps to tell that person about the collection, unless an exception applies.

Keep reading

Where your data lives, and why New Zealand businesses ask

How the Privacy Act treats overseas storage and cloud providers, and what you stay responsible for.

Writing a data sharing agreement that does its job

The clauses worth your attention when personal or commercial information is shared with another party.

How a chained audit log works

What a data room records, why each entry is linked to the one before, and what that does and does not tell you.