New Zealand’s Privacy Act 2020 requires reasonable security safeguards (IPP 5) and makes breaches likely to cause serious harm notifiable to the Office of the Privacy Commissioner and affected people ‘as soon as practicable’ — OPC guidance says within 72 hours. No law mandates ISO 27001. Certification is the practical way to evidence the safeguards IPP 5 assumes.
New Zealand consolidated its rules in the Privacy Act 2020, which replaced the Privacy Act 1993 and is enforced by the Office of the Privacy Commissioner (OPC). Two parts of it do the security work.
IPP 5 requires agencies to protect personal information with reasonable security safeguards. Like every law on this hub, it’s technology-neutral — no standard, no certificate, no control list. What counts as reasonable is yours to establish and, if a complaint or a breach arrives, yours to prove.
The notifiable-breach regime (ss 112–117) turns on one test: serious harm. A privacy breach that causes, or is likely to cause, serious harm must be notified to the Office of the Privacy Commissioner and to the affected people, as soon as practicable. OPC guidance puts a number on that phrase: within 72 hours, even if you’re still investigating. And the regime has an edge — failing to notify the Commissioner is an offence.
| Privacy Act element | What it asks of you |
|---|---|
| IPP 5 | Reasonable security safeguards for personal information |
| ss 112–117 | Notify the OPC and affected people of serious-harm breaches as soon as practicable — 72 hours per OPC guidance |
| IPP 12 | Safeguards when disclosing personal information overseas (no residency rule) |
Beyond the Privacy Act, New Zealand has no dedicated general cybersecurity statute for organisations. The sector exception is TICSA — the Telecommunications (Interception Capability and Security) Act 2013 — which puts network-security duties on public telecommunications network operators, including notifying the National Cyber Security Centre (NCSC). Unless you run a public telecommunications network, the Privacy Act is your main legal hook, and customer questionnaires do the rest of the enforcing.
“Reasonable security safeguards” and ISO 27001 are shaped for each other. The standard doesn’t hand you a fixed checklist either — it hands you a method: assess risk across the 93 Annex A controls, record what applies in the Statement of Applicability, and evidence that the applicable controls operate. That written, independently audited case is what “reasonable” looks like when the OPC, a customer, or an insurer asks.
| New Zealand obligation | Where the ISMS answers it |
|---|---|
| IPP 5 reasonable safeguards | Risk assessment plus Statement of Applicability, with audit evidence the controls run |
| The serious-harm test | Logs and monitoring that can establish what was accessed and who is affected — the inputs the test needs |
| Notify as soon as practicable (72-hour guidance) | Incident management with detection in front of it, so “practicable” is measured from a monitored alert, not a customer’s complaint |
| IPP 12 overseas disclosure | Supplier and transfer controls, with records of where personal information flows and what protects it there |
The trans-Tasman angle matters here. Accreditation is joint: JAS-ANZ — the Joint Accreditation System of Australia and New Zealand — accredits certification bodies on both sides of the Tasman. A certificate over a New Zealand scope carries the same accreditation weight in Sydney as in Wellington, so NZ companies selling into Australia, and Australian groups with NZ operations, can run one ISMS across both countries and certify once.
The certification audit — Stage 1 documentation review, then Stage 2 interviews and evidence — is performed by a JAS-ANZ-accredited certification body, never by Secure60. Audit fees are set by the certification body and vary with the size and scope of the certified system; annual surveillance audits and three-yearly recertification follow.
Secure60 has delivery infrastructure in New Zealand via Rackcorp, with a datacentre in-country, so log collection and monitoring can run onshore on our security platform where customers expect it. Infrastructure, not offices — and never the audit.
“As soon as practicable” gets read as soft — a phrase to negotiate with later. The OPC’s guidance removes that comfort twice over. First, the 72-hour expectation applies even if you’re still investigating: “we didn’t have the full picture yet” is anticipated by the guidance, not accepted as a reason to wait. You notify on what you know and keep investigating. Second, failing to notify the Commissioner is an offence, which makes under-notifying the expensive direction to be wrong in.
Both points push the same way. The serious-harm test has to be run early, on evidence — what was touched, who’s affected — and evidence that exists at hour one comes from monitoring that was running at hour zero.
Tools hand you a to-do list. We do the list — and run the security behind it. For New Zealand that means an ISMS built against the Privacy Act 2020, with the logging, monitoring and incident management that make a 72-hour serious-harm call possible, running on Rackcorp infrastructure in-country where onshore matters. The certification audit belongs to a JAS-ANZ-accredited certification body; we make sure what it samples is real. We’re ISO 27001:2022 certified ourselves and face the same auditors.
Is ISO 27001 legally mandatory in New Zealand?
No. The Privacy Act 2020’s IPP 5 requires reasonable security safeguards without naming a standard. A certified ISMS is the practical way to show what your safeguards are, why they’re reasonable, and that an independent auditor has seen them running.
What does the Privacy Act require after a breach?
If a privacy breach causes, or is likely to cause, serious harm, you must notify the Office of the Privacy Commissioner and the affected people as soon as practicable. OPC guidance says notify within 72 hours even if you’re still investigating. Failing to notify the Commissioner is an offence.
Does New Zealand have a general cybersecurity law?
No dedicated general statute for organisations. Sector-specific duties exist — the Telecommunications (Interception Capability and Security) Act 2013 (TICSA) imposes network-security duties on public telecommunications network operators, including notifying the NCSC. For everyone else, the Privacy Act’s IPP 5 is the main legal hook.
Who performs the ISO 27001 certification audit in New Zealand?
A certification body accredited by JAS-ANZ, the Joint Accreditation System of Australia and New Zealand — not Secure60. Audit fees are set by the certification body and vary with the size and scope of what’s being certified.
Does data have to stay in New Zealand?
The Privacy Act has no residency rule. IPP 12 instead sets safeguards for disclosing personal information overseas — a controls-and-contracts question your ISMS records. Where your data should live is then driven by customers and sector expectations.
Can Secure60 deliver in New Zealand?
Yes — we have delivery infrastructure in New Zealand via Rackcorp, with a datacentre in-country, so log collection and monitoring can run onshore. We don’t have local offices, and we never perform the certification audit.
