The Office of the Privacy Commissioner (OPC) has released its report on the second stage of its inquiry into the Manage My Health (MMH) breach, heralding it as a “wake-up call” for agencies about how they handle personal information.

This significant report is a call to action for all New Zealand organisations to look closely at their own privacy practices. The OPC has clearly outlined the standards it expects to be met, providing agencies that currently fall short with a blueprint for change.

Background

In December 2025, a cyber-attack on the MMH patient portal resulted in the theft of patient health documents. The OPC inquired into the breach in two phases: Phase 1 examined security failures and legal accountability, and the recently released Phase 2 report examines the wider privacy issues the breach exposed.

In this article we look beyond the specifics of the MMH incident to set out what all organisations can learn from the OPC’s inquiry, and what boards and senior leaders should be considering.

The OPC's guidance

1.  Know what you hold and why - and make sure your customers do too

Organisations should be able to trace what information is collected at each point in a customer journey, why it is needed and the legal basis for holding it.

Where agencies are relying on authorisation as a legal basis for collecting, using or disclosing personal information, the OPC expects them to be able to show that those individuals knew what they were agreeing to. Clear and precise documentation is needed.

The report contains important lessons for organisations that hold information in user accounts. It makes it clear that agreement by an individual to create a user account may not, by itself, authorise the ongoing collection and storage of further information in that account. Agencies should not assume that authority has been given by people who have not activated an account.

2.  Ensure personal information is not held longer than it is needed

Organisations must not hold personal information for longer than necessary. The OPC’s view is that unless there is a specific reason to retain it, it is general best practice to check in with an account holder after 12 months of inactivity to ask whether they want to keep the account, and to review access and retention arrangements when a customer’s circumstances change.

All agencies operating customer accounts should have a clear process for identifying and managing dormant or unused accounts, and for handling access when circumstances change, such as a change in legal authority over an account or the death of an account holder.

3.  Processors can become principals

Where a service provider that is intended to be a mere agent holding information on behalf of a customer makes a design decision that goes beyond its customer’s instructions, it may become independently liable under the relevant privacy principles, whether or not it actively uses the information. The lesson for service providers is that their instructions mark the limits of their protection. Any change to how client information is collected, matched or stored should be clearly authorised by the client. Going beyond what is agreed may mean that they take on the responsibilities of a principal agency under the Act.

4.  Clarity in contracts throughout the supply chain

The report contains helpful guidance from a contractual perspective, recording the OPC’s views that:

• contracts between agencies dealing with data should clearly reflect how information is actually handled and who is legally responsible for it;

• these contracts should also make it clear who should lead notifications in the event of a breach and provide practical instructions for doing so. Arguing about this in the midst of an incident response wastes time and creates confusion; and

• contractual provisions that purport to exclude or limit liability for privacy breaches caused by criminal attacks are legally invalid and misleading under the Privacy Act, since agencies cannot contract out of most of their legal obligations under the Act or applicable codes.

5. Be prepared for a serious breach

All agencies should have a proper breach or crisis management plan. Among other things, organisations should know:

• whether they have ready access to affected people’s contact details and, if not, who holds those details;

• how information will be distributed;

• who will deal with media and regulator enquiries;

• how breaches will be escalated quickly to appropriate staff;

• how key people will be contacted outside normal working hours, including over holidays; and

• how legal, technical and support services can be scaled up during a major incident.

Organisations should also make sure the people responsible for breach response understand the “serious harm” threshold for notification under the Privacy Act. The OPC expects agencies to notify it within 72 hours of becoming aware of a notifiable breach, including over weekends and holidays, though this is a guideline rather than a fixed rule. Agencies do not need to know every detail before notifying.

Failing to notify the OPC as soon as practicable without reasonable excuse is an offence under the Privacy Act, with a maximum fine of $10,000.

The same expectation of preparedness applies to notifying affected individuals. Whether notification is made “as soon as practicable” depends not only on what the agency did, but on what a reasonable organisation should have been able to do in the circumstances. The OPC has stated that poor processes for identifying or managing breaches are not a reasonable excuse for delay.

6. Put affected people at the centre of the breach response

How an agency communicates during a breach can be just as important as the technical response. The OPC emphasises the need to balance speed with accuracy. Agencies should act with appropriate urgency, but avoid notifying people so quickly that they are incorrectly told they are affected or given inaccurate information. The OPC describes the preferred approach as "calm and measured".

Agencies should consider practical steps to reduce harm and support affected people, such as dedicated support services and, where appropriate, legal steps to restrict further dissemination of stolen information (such as injunctions). Communications should focus on the harm to affected people rather than the agency as the victim of an attack, and agencies should consider whether culturally relevant engagement or support is needed.

Our recommendations: What should boards and senior leaders do now?

The consequences of a privacy failure can extend well beyond the immediate incident, affecting trust and confidence in an organisation and the wider services it is part of. For organisations, this makes privacy a strategic and reputational risk, not only a compliance issue.

Boards and senior leaders should seek assurances that their organisation has considered the following practical steps to review and strengthen its privacy practices. Breach preparedness and supplier accountability warrant particular attention:

• Map what information you collect and why: Check what personal information you collect at each stage of the customer journey, whether you have authority to collect it, and whether that authority still applies as circumstances change. Update your customer-facing documents if they are not fit for purpose.

• Review how long information is kept: Identify dormant and inactivated accounts and check whether there is still a lawful purpose for retaining the information. The OPC considers checking in with account holders after 12 months of inactivity to be general best practice, unless there is a reason for a different approach.

• Test your privacy notices: Check that information about what you collect, why you collect it and what you do with it is clear and easy to understand. Consider testing notices with the people who will use them.

• Check third-party arrangements: Make sure contracts, system design and day-to-day practices are aligned, particularly on who can make decisions about personal information and for what purposes, and who will notify and communicate with affected people if a breach occurs. Check that contracts do not purport to exclude or limit an agency’s statutory obligations.

• Stress-test your breach response plan: Check that the right people understand the serious-harm threshold, know how and when to escalate a breach, and can identify and contact affected people quickly, including outside normal working hours.

• Plan how you would communicate and provide support: Consider who is best placed to contact affected people, how communications would be coordinated, and what practical steps could be taken to reduce harm and provide appropriate support.

• Keep privacy controls under review: Do not treat compliance as a one-off exercise. Check that privacy and security controls continue to work as systems, services and customer relationships change.

Get in touch

If you would like to discuss what the report means for your organisation, or how to strengthen your privacy practices and breach preparedness, please contact one of our privacy experts.

Special thanks to Priya Prakash and Julia Wynands for their assistance in writing this article.