ShareAndGoShareAndGo

Privacy

What the Privacy Act means when you share documents.

Every New Zealand business that holds personal information is covered by the Privacy Act, which came into force on 1 December 2020. Much of the attention goes to collecting information. Less goes to what happens when documents full of it are shared with advisers, buyers, investors or other agencies.

This article walks through the parts of the Act that matter most when documents leave your hands. It explains the obligations in plain terms; it is not advice about your situation, and your own adviser should help you apply it.

Thirteen principles, a few that matter most here

The Act is built around information privacy principles, or IPPs. The Office of the Privacy Commissioner lists thirteen, numbered 1 to 13, plus principle 3A, which deals with what to tell people when you collect their information from another source and which the Office says came into effect in May 2026.

When the question is sharing documents, four principles do most of the work:

  • Principle 5, storage and security: keep personal information safe with reasonable safeguards.
  • Principle 9, retention: do not keep it longer than you need it.
  • Principle 11, disclosure: only disclose it in the circumstances the principle allows.
  • Principle 12, disclosure outside New Zealand: extra conditions apply when information goes to a foreign person or entity.

Principle 5: reasonable safeguards

Principle 5 says an agency that holds personal information must ensure it is protected by security safeguards that are reasonable in the circumstances against loss, unauthorised access, use, modification or disclosure, and other misuse.

It goes further than many people realise. If it is necessary to give the information to someone in connection with providing a service to the agency, the agency must do everything reasonably within its power to prevent unauthorised use or disclosure. In other words, when you hand documents to an adviser or a supplier, your responsibility does not end at the handover.

What is reasonable depends on the sensitivity of the information and the risks. Employee health records sent to an insurer call for more care than a list of supplier contacts. For document sharing, the practical questions are simple: who can open this, can they copy it, can access end, and would we know if something went wrong.

Principle 9: not keeping it longer than needed

Principle 9 says an agency must not keep personal information for longer than is required for the purposes for which it may lawfully be used. Shared documents are easy to forget. A due diligence room from two years ago, a folder of tenant files sent to a former property manager, or a copy of payroll data held by an adviser after the engagement ended all sit uncomfortably with this principle.

It helps to plan the end of a sharing arrangement at the start. In ShareAndGo, invitations can carry an end date, rooms can be exported as a ZIP with an index of every document, and deleting from the recycle bin removes the stored files and their previews.

Sharing with providers, including overseas ones

Section 11 of the Act deals with information one agency holds on behalf of another, for example as its agent or for safe custody or processing. In that situation the information is treated as held by the agency it is held for, not by the provider, unless the provider uses or discloses it for its own purposes. The section applies whether or not the provider is outside New Zealand.

The Office of the Privacy Commissioner's guidance on principle 12 gives an example: a New Zealand company that contracts an overseas cloud storage provider to store customer information is treated as holding that information, and principle 12 does not apply because nothing has been disclosed. The guidance adds that this holds so long as the provider is not using the information for its own purposes. Your business remains responsible for how the information is looked after.

Principle 12 itself applies when you disclose personal information to a foreign person or entity that is not acting as your agent. Before doing so, you need one of the grounds it sets out, such as reasonable grounds to believe the recipient is subject to privacy laws that, overall, give similar protection, or the individual's authorisation after being expressly told the information may not be protected to the same standard.

When something goes wrong

The Act defines a privacy breach as unauthorised or accidental access to, or disclosure, alteration, loss or destruction of, personal information, or an action that prevents the agency accessing it. A breach is notifiable when it is reasonable to believe it has caused, or is likely to cause, serious harm.

For a notifiable breach, the agency must notify the Privacy Commissioner as soon as practicable after becoming aware of it, and notify affected individuals as soon as practicable too, unless an exception applies. Failing to notify the Commissioner without reasonable excuse is an offence under the Act. Our breach playbook covers the steps in more detail.

Turning the principles into habits

  • Share access, not copies, for anything containing personal information.
  • Give each outside party only the folders they need. ShareAndGo groups make this a setting rather than a separate copy of the files.
  • Use view-only access and personal watermarks where people only need to read.
  • Set end dates on invitations, and review who still has access when a matter closes.
  • Keep the audit log, so you can reconstruct who saw what if a question ever arises.

ShareAndGo does not make anyone meet their obligations under the Act; that depends on how a business handles information overall. What it does is give you controls and records that make the principles easier to follow when documents leave your organisation.

Questions people ask

Does the Privacy Act apply to small businesses?
The Act applies to agencies, which include businesses of any size, with limited exceptions such as individuals acting in their personal or domestic affairs. The Office of the Privacy Commissioner's website explains who is covered.
Is using an overseas provider a disclosure under principle 12?
According to the Office of the Privacy Commissioner, storing information with an overseas provider that acts as your agent is not treated as a disclosure under principle 12, so long as the provider does not use the information for its own purposes. You stay responsible for how it is looked after.
What is principle 3A?
Principle 3A covers what you must tell people when you collect their personal information from someone other than them. The Office of the Privacy Commissioner says it came into effect in May 2026.

Related reading

A notifiable privacy breach playbook

The steps the Privacy Act sets out when personal information goes astray.

How ShareAndGo protects documents

Verified recipients, watermarked view-only sharing, virus scanning and a chained audit log.

Email attachments and client confidentiality

Why attachments are a common route for privacy breaches, and what to use instead.