---
title: "Assess a notifiable privacy breach under the Privacy Act 2020"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack/new-zealand"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-T1-R3-NZ"
practice_area: "Privacy, Data Protection & Cyber"
tier: "red"
lawyer_review: "required"
jurisdictions: ["NZ"]
last_reviewed: "2026-09-23"
---

# Assess a notifiable privacy breach under the Privacy Act 2020

> Extract what was disclosed, to whom, and the categories of people affected.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack/new-zealand  
Last reviewed: 2026-09-23

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Red: Lawyer writes; AI may check, clarify or collect data |
| How AI is used | Extract what was disclosed, to whom, and the categories of people affected. |
| What the lawyer must review | Decide whether serious harm is caused or likely If so, notify the Commissioner and affected people as soon as practically able Do not file an OAIC NDB form Call Police first if harm is imminent |
| Written for | New Zealand |
| Applies to | [Assess a suspected data breach and draft the notification pack](https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack.md) |

## Checking plan

- What the AI does: Extract what was disclosed, to whom, and the categories of people affected.
- Basis: Checked against the linked sources on 23 September 2026. Confirm the current instrument before reliance.

## Notes

- Differs from Australia: notification is under the Privacy Act 2020, not the OAIC notifiable data breaches scheme.
- Notify Us is the Commissioner's reporting channel.

## Sources

- [OPC: privacy breaches](https://www.privacy.org.nz/responsibilities/privacy-breaches/) (checked 2026-09-23)
- [OPC: information privacy principles](https://www.privacy.org.nz/privacy-principles/) (checked 2026-09-23)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*