Your Business Has Had a Data Breach: What to Do Next in New Zealand
A data breach needs two things at the same time: technical containment and a clear business response. Moving too slowly increases the damage. Moving too quickly without understanding what happened can destroy evidence or lead to the wrong people being notified.
1. Contain the incident
Stop the exposure where you safely can. That might mean disabling an account, revoking sessions, isolating a device, removing a public share or blocking a malicious forwarding rule. Avoid wiping or rebuilding affected systems until the incident has been assessed and useful evidence preserved.
2. Work out what information was involved
Identify what systems were affected, whose information may have been accessed or disclosed, what type of information was involved and whether the exposure is still continuing.
The sensitivity of the information matters. Health information, financial data, identity documents and confidential client records can create very different harm from a low-sensitivity contact list.
3. Assess whether the breach may cause serious harm
Under the NZ Privacy Act 2020, a privacy breach that has caused or is likely to cause serious harm must be notified to the Office of the Privacy Commissioner. Affected people generally also need to be told unless an exception applies.
The Privacy Commissioner provides the NotifyUs tool to help organisations assess and report a breach. The Commissioner's current guidance says notification should happen as soon as practicable and indicates an expectation of reporting within about 72 hours after becoming aware that a breach is notifiable.
4. Preserve a timeline
Record when the incident was detected, what actions were taken, which accounts or devices were involved, what evidence supports your conclusions and who made key decisions. That timeline helps both the technical investigation and any privacy, insurance or client response.
5. Notify the right parties
Depending on the incident, that may include the Privacy Commissioner, affected people, your cyber insurer, legal advisers, banks or payment providers, and the National Cyber Security Centre. Do not assume every security incident is automatically a notifiable privacy breach; make the assessment against the information and likely harm involved.
6. Recover from a trusted position
Reset affected credentials, remove persistence, restore systems where required and verify that the original access path has been addressed before normal operation resumes. If backups are involved, confirm the restore point itself is trustworthy.
7. Fix the control failure, not just the symptom
Once the immediate incident is contained, ask what allowed it to happen or made the impact worse: identity configuration, unpatched software, excessive access, lack of monitoring, weak offboarding, unsafe sharing or inadequate recovery controls.
If you are dealing with a live cyber incident, contact your IT/security provider immediately. For broader preparedness, our IT Security Self-Check highlights common control gaps, while our cyber-security service covers prevention, monitoring and recovery.