The Privacy Act 2020 and Your Business: What You Need to Know

What the Privacy Act 2020 Means for Your Business

The Privacy Act 2020 replaced the Privacy Act 1993 and introduced significant new obligations for businesses that collect and hold personal information. It has since been amended, most notably by the Privacy Amendment Act 2025, which added a new information privacy principle from 1 May 2026.

Mandatory Breach Notification

The most significant change for businesses is mandatory breach notification. The Office of the Privacy Commissioner (OPC) explains that a notifiable privacy breach is one where personal information has been accessed, disclosed, altered, lost or destroyed without authorisation, and it is reasonable to believe an affected individual has suffered serious harm or is likely to. When that threshold is met, the OPC's privacy breach guidance says you must notify the Privacy Commissioner and any affected people as soon as you are practically able.

The OPC gives examples of serious harm including physical harm or intimidation, financial or credit fraud, family violence, and psychological or emotional harm. It has said it expects notification within 72 hours of an agency becoming aware that a breach is notifiable, and its NotifyUs tool helps businesses assess whether a breach meets the threshold.

The Cost of Notification

Notifying affected individuals sounds straightforward, but the work adds up quickly. A breach notification programme can involve:

• Legal review of notification obligations and content
• Individual notification letters or emails
• A call centre or helpline to handle customer enquiries
• Credit or identity monitoring where financial or identity data was exposed
• Media statements and communications management

The total depends heavily on how many people are affected, what information was involved, and how quickly the business can establish the facts. These are the costs that the breach response section of a cyber policy is typically designed to address, subject to the limits and conditions in the wording.

Penalties and Consequences

The OPC's guidance on consequences states that failing to report a notifiable privacy breach to the OPC is an offence under section 118 of the Privacy Act 2020. Separately, an affected person can complain to the OPC, and the same guidance explains that matters which cannot be resolved can be taken to the Human Rights Review Tribunal. The Tribunal decides whether to award compensation; the OPC notes that less serious cases range up to $10,000, more serious cases sit between $10,000 and about $50,000, the most serious start at $50,000, and the highest award so far is just over $168,000.

New From 1 May 2026: Information You Collect From Someone Else

The Ministry of Justice confirms that IPP3A came into force on 1 May 2026. It requires a business that collects personal information about someone from a third party, such as a referral partner or data provider, to take reasonable steps to tell that person about the collection, its purpose, the intended recipients, who holds the information, and their rights of access and correction, unless an exception applies. We cover the detail in IPP3A explained.

Practical Steps for Businesses

To meet your Privacy Act obligations, businesses should:

• Maintain a data register: know what personal information you hold, where it is stored, and where it came from
• Have an incident response plan that includes a breach assessment and notification process
• Train staff to recognise and report potential breaches promptly
• Appoint a privacy officer; the OPC states that every agency is required to have one
• Review privacy statements and partner agreements for indirect collection under IPP3A
• Check that your cyber insurance includes breach response and regulatory investigation cover

How Cyber Insurance Helps

Many cyber policies include sections covering legal advice on notification obligations, notification and breach response costs, and the costs of responding to a regulatory investigation. Whether fines or penalties are covered is more limited and depends on the wording and on whether they are legally insurable. Checking those sections before an incident allows a business to respond quickly and correctly, rather than working out what is covered in the middle of a breach.