Purpose
The Privacy Act protects people’s personal information. It sets rules for organisations that collect or hold information, such as names, addresses, health details or contact information. It also lets people ask to see their information and request corrections if something is wrong.
Main rules
In simple terms, organisations should:
- Collect only what they need for a clear, lawful reason.
- Explain why they are collecting it and how it may be used or shared.
- Keep it safe from loss, theft or access by people who should not see it.
- Check that it is accurate before using or sharing it.
- Share it only when allowed and take care when sending it overseas.
- Let people see and correct their information when they ask.
Why it matters for IT
These rules affect how websites, apps, databases and computer systems are built and managed. For example, an organisation should avoid asking an app user for unnecessary details, limit staff access to sensitive records, protect stored information, and check privacy before sharing data with another company.
Māori data sovereignty
The Privacy Act mainly protects information about individual people. Māori data sovereignty is broader. Te Mana Raraunga says Māori should have a say in how information about Māori people, culture, land and communities is collected, kept, used and shared.
This matters because data can affect a whole community, even when it does not identify one person. For example, information could reveal sensitive cultural knowledge or lead to unfair conclusions about an iwi. Protecting Māori data means keeping it secure and involving Māori in decisions about who can use it and for what purpose.
So, the Privacy Act is an important starting point, but it does not cover every Māori community or cultural interest by itself. (Privacy Act 2020; Te Mana Raraunga)
NZ Cyber Security Strategy 2019
Purpose
The strategy described how the Government wanted to help New Zealanders stay safer online. It treated cybersecurity as a shared responsibility between government, businesses, communities and individuals.
Main goals
The strategy aimed to:
- Help people understand online dangers and protect themselves.
- Build more cybersecurity skills and expertise.
- Work with other countries to respond to cyber threats.
- Improve how New Zealand prevents and responds to cybercrime.
How it helps organisations
The strategy gave organisations direction, rather than a step-by-step technical checklist. In everyday terms, it encouraged them to protect important information and systems, teach staff how to spot online threats, prepare for cyber incidents, and work with suppliers to reduce security risks.
The 2019 strategy has since been replaced, but it explains New Zealand’s cybersecurity priorities at that time. (DPMC: Cyber Security Strategy 2019)
