Many Privacy Act obligations are met or missed in schema design, logging defaults and integration code, well before any lawyer sees the system. This is how we read the Privacy Act 2020 from an engineer's seat. It is general information, not legal advice.
Collect less
IPP 1 allows collection only for a lawful purpose connected with your functions, and only where the information is necessary for that purpose. If the purpose doesn't require someone's identifying information, you can't require it.
For engineers, this means every required form field and stored attribute needs a reason. Accidental collection counts too: request bodies in debug logs, analytics payloads, support screenshots.
Decide how long, then automate it
IPP 9 says you shouldn't keep personal information longer than you need it for the purpose. It sets no fixed period, so you have to decide one, bearing in mind that other laws may require you to keep certain records.
Give each data category a retention period and an owner, then implement the deletion as a scheduled job. Remember the copies: logs, data warehouses, staging databases restored from production, and backups.
Build for access and correction
IPP 6 gives people the right to access their information, and IPP 7 covers correction. The Commissioner's guidance on requests says you generally have 20 working days to respond.
Without some engineering, finding one person's data across a dozen systems is slow and error-prone. Keep a map of where personal information lives and how each system is keyed. Build an internal export before you need it, and verify the requester's identity.
Know the notifiable-breach test
A privacy breach includes unauthorised or accidental access, disclosure, alteration, loss or destruction, as well as an action preventing you from accessing the information, even temporarily. So ransomware can qualify even if nothing was copied.
A breach is notifiable when it is reasonable to believe it has caused serious harm to an affected individual or is likely to. Section 113 requires you to consider:
- Any action taken to reduce the risk of harm.
- Whether the information is sensitive.
- The nature of the harm that may be caused.
- Who has obtained or may obtain the information.
- Whether it is protected by a security measure.
- Any other relevant matters.
The Act says to notify the Commissioner and affected people as soon as practicable after becoming aware. The Commissioner's guidance adds an expectation of notification within 72 hours of becoming aware that a breach is notifiable, described as a guide only. What your employees or agents know is treated as known by the organisation, so an engineer's discovery can count even if the privacy officer hasn't heard. You can notify in stages, and the NotifyUs tool helps with assessment and reporting. Failing to notify the Commissioner without reasonable excuse is an offence, with a fine of up to $10,000.
Access logs should show which records were touched, because "we can't tell" makes the assessment much harder. Encryption helps only if the keys weren't exposed too.
Overseas disclosure
IPP 12 limits disclosure of personal information outside New Zealand. Broadly, you need reasonable grounds to believe the recipient will protect it with safeguards comparable to the Act's, or another listed basis such as the person's authorisation after being told the risks. The Commissioner publishes model contract clauses as one way to do this.
Cloud hosting is treated differently in most cases. The Commissioner's guidance explains that under section 11, information a provider holds as your agent is generally treated as held by you, unless the provider uses or discloses it for its own purposes. You remain responsible for it, wherever the servers are. Check vendor terms for product improvement or model training clauses, since they may change the analysis.
IPP 3A changes integrations
IPP 3A, added by the Privacy Amendment Act 2025, took effect on 1 May 2026. When you collect personal information from someone other than the individual, you must take reasonable steps to make them aware, as soon as reasonably practicable after collection, unless an exception applies. They need to know:
- That the information has been collected, and why.
- The intended recipients.
- Your name and address.
- Any law authorising or requiring the collection.
- Their rights of access and correction.
The guidance confirms that this applies only to information collected from 1 May 2026, and to any indirect source. Partner APIs, CRM imports, enrichment services and purchased lists are all places to look. Exceptions exist, including where the person is already aware or the information is publicly available, but you need to be able to justify relying on one.
In practice, store the source, collection date and notification status with indirectly collected records.
What to do this week
- List every inbound feed that carries personal information, and mark who notifies the individual.
- Search your logs for email addresses and names you didn't intend to store.
- Pick one data category and write its retention rule into a scheduled job.
- Check your on-call engineers know that finding a privacy breach may start the clock.