Privacy Act 2020, Notifiable Privacy Breaches
Privacy Act 2020 (NZ), No 31, ss. 112-118
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 December 2020.
A breach notification rule binding public and private bodies.
As of 6 September 2026.
What it requires
- Notify the Privacy Commissioner as soon as practicable after becoming aware that a notifiable privacy breach, one reasonably believed to have caused or be likely to cause serious harm, has occurred.
- Notify each affected individual, or give public notice if individual notice is not reasonably practicable, as soon as practicable after becoming aware of a notifiable privacy breach, unless a statutory exception or permitted delay applies.
- Failing to notify the Commissioner of a notifiable privacy breach without reasonable excuse is an offence carrying a fine of up to $10,000.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Under s. 118(1), an agency that, without reasonable excuse, fails to notify the Commissioner of a notifiable privacy breach under s. 114 commits an offence and is liable on conviction to a fine not exceeding $10,000.
Penalty structure
Fine on conviction for failing to notify the Commissioner of a notifiable privacy breach without reasonable excuse, under s. 118(1).
- Rule
- Fixed only
- As of
- 6 September 2026
- Currency
- NZD
- Fixed cap
- 10,000
Who enforces it
Enforcement body
Office of the Privacy Commissioner
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
An agency must notify the Privacy Commissioner as soon as practicable after becoming aware that a notifiable privacy breach, one reasonably believed to have caused serious harm to an affected individual or to be likely to, has occurred. It must also notify each affected individual, or give public notice where individual notice is not reasonably practicable, unless a section 116 exception applies or a permitted delay is in effect.
An agency that, without reasonable excuse, fails to notify the Commissioner commits an offence carrying a fine of up to $10,000.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachhigh_risk_decisions
Read the law
official consolidated Act text, New Zealand Legislation