ShareAndGoShareAndGo

Security

Where the cost of a privacy breach really lands.

When people think about the cost of a data breach, they picture ransom demands and headlines. For most New Zealand small businesses, the cost is quieter and more spread out: days of staff time, awkward phone calls to clients, work that stops, and trust that takes longer to rebuild than any system.

This article looks at where those costs come from, using official figures where they exist, and at the practical steps that reduce them.

Breaches are common, and becoming more so

The Office of the Privacy Commissioner's annual report for 2024/25 says 1,093 privacy breach notifications were made to it that year, a 27 percent increase on the year before. These are only the breaches organisations reported; many smaller incidents never reach the threshold for notification.

Cyber incidents are part of the picture. The National Cyber Security Centre's analysis of incidents handled through its general triage process from 1 July 2024 to 30 June 2025 lists 2,111 reports of scams and fraud and 1,994 reports of phishing and credential harvesting. Many breaches, though, begin with nothing more sophisticated than a document sent to the wrong person.

Cost 1: the response itself

The first and most certain cost is time. Someone has to work out what happened, which information was involved, who might have it and whether it has been contained. In a small business that is usually the owner or a senior staff member, which means their normal work stops.

Good records shorten this dramatically. If you can see exactly who opened a document and whether anyone downloaded it, the investigation takes hours rather than days. If the document travelled by email attachment, you may never know for certain, and uncertainty costs more than a clear answer.

Cost 2: notification and follow-up

Under the Privacy Act, a breach that it is reasonable to believe has caused or is likely to cause serious harm must be notified to the Privacy Commissioner and to affected people as soon as practicable. The Office of the Privacy Commissioner says it expects notification within 72 hours of becoming aware.

Notification takes work: drafting clear messages, contacting each person, answering their questions and responding to any follow-up from the Office. Failing to notify the Commissioner without reasonable excuse is an offence under the Act, so the cost of getting it wrong is higher still. Many businesses also bring in an adviser at this point, which is money well spent but money nonetheless.

Cost 3: clients and counterparties

For professional firms and businesses that hold client information, the largest cost is often trust. A client whose records were exposed may move to another firm, and the story travels by word of mouth in a small market. A counterparty in a negotiation whose information leaked may walk away from the deal or demand tougher terms.

These costs rarely appear on an invoice, which is exactly why they are easy to underestimate.

Cost 4: disruption

If the breach involved a compromised account or malware, systems may need to be shut down, cleaned and restored. Staff cannot work while that happens. Even a simple incident usually means changing passwords, reviewing access across several systems and checking that nothing else was affected.

Insurance can help with some of these costs, but policies have conditions, including prompt notification. Know what your policy requires before you need it.

What reduces the cost

Most of the cost of a breach is set before it happens, by the habits and tools already in place. A few make the biggest difference:

  • Share access instead of copies. A document that never left your control is far easier to contain.
  • Verify who opens confidential documents. ShareAndGo recipients confirm their email address with a six-digit code.
  • Limit downloads for sensitive material. View-only recipients see documents rendered on our side, watermarked with their name, email address and the date.
  • Keep a record you can rely on. ShareAndGo's audit log records every view and download, with entries chained so alterations can be detected.
  • Give access an end date, so former parties do not keep it indefinitely.
  • Scan everything that comes in. ShareAndGo serves no upload until its virus scan is clean.
  • Turn on two-step verification for every account that can reach client information.

None of these remove the risk entirely. Together, they turn a breach from a long, uncertain investigation into a contained incident with clear answers, which is where most of the saving lies.

Questions people ask

How many privacy breaches are reported in New Zealand?
The Office of the Privacy Commissioner's annual report for 2024/25 says 1,093 privacy breach notifications were made to it that year, a 27 percent increase on the previous year.
Is a small business covered by the breach notification rules?
Yes. The Privacy Act applies to agencies, which include businesses of any size. If a breach is likely to cause serious harm, it must be notified.
What is the cheapest way to reduce breach costs?
Good habits before anything goes wrong: sharing access rather than copies, two-step verification on every account, and a reliable record of who opened what.
What is the cheapest part of a breach response?
Preparation. Knowing in advance who decides, who notifies and where your records are kept costs very little, and it shortens every later step when something does go wrong.

Related reading

A notifiable privacy breach playbook

The steps to take when personal information goes astray.

The first 24 hours after a suspected leak

A practical plan for the first day.

How ShareAndGo protects documents

Verified recipients, watermarked view-only sharing, virus scanning and a chained audit log.