Data Breach Insurance NZ — What Cover Responds, and What the Privacy Act 2020 Requires

What "data breach" means in New Zealand

The Privacy Act 2020 defines a privacy breach as unauthorised or accidental access to, disclosure of, alteration of, loss of, or destruction of personal information held by an agency, or any action that prevents the agency from accessing the information. The trigger for notification, set out in sections 113–118 of the Act, is whether the breach has caused — or is likely to cause — serious harm.¹

The Privacy Commissioner's published guidance lists the factors that go into the serious-harm assessment: the type of information involved, the likely use of the information by an unauthorised recipient, whether the information was protected by security measures, and the number of people affected.² A name and email address exposed via an inadvertent CC is rarely notifiable; a database of customer names plus financial details exfiltrated by an attacker almost always is.

For health agencies, the Health Information Privacy Code (HIPC) sits on top of the Act and applies a stricter lens to medical data. Sector codes for credit reporting, telecommunications, justice, and superannuation likewise modify the baseline.

What data breach insurance actually pays for

Cyber policies don't typically have a separate "data breach" section — they have an event response section that triggers when a covered cyber event occurs. For privacy breaches, that section pays for:

• Forensic investigation — establishing what was accessed, by whom, and whether the attacker still has a foothold. This usually has to be done by the insurer's pre-approved forensics firm; using your own consultants without insurer sign-off can void cover.
• Legal advice — particularly the work of deciding whether the breach is notifiable, drafting the Commissioner notification, and advising on customer-facing disclosure.
• Notification costs — letters, emails, call centre, and credit-monitoring offers. Sublimits typically scale with the number of affected individuals.
• Public relations — pre-vetted PR firms who handle media response and customer communications during the first 72 hours.
• Regulatory defence — lawyer time to engage with the Privacy Commissioner during an investigation, and any sector-regulator engagement (FMA for listed companies, RBNZ for banks).

Beyond response, you also need business interruption (income lost while systems are down), restoration costs (rebuilding systems), and third-party liability (claims from individuals or corporate customers whose data was exposed). Most NZ wordings bundle these under a single cyber policy with section sublimits.

The first 72 hours — a typical sequence

The single biggest determinant of whether a privacy breach lands as a manageable event or a defining crisis is the first 72 hours. With cover in place, the sequence usually looks like this:

1. Hour 0 — discovery. Someone notices anomalous activity, an alert fires, or a customer reports something. Document the time and what you saw.
2. Hour 1–4 — containment. Isolate affected systems. Don't shut everything down without forensics input — premature shutdown can destroy evidence.
3. Hour 4–8 — call your broker / insurer hotline. Most NZ cyber policies have a 24/7 incident hotline. Trigger the policy. The insurer engages forensics, legal, and PR partners.
4. Day 1–2 — scoping. Forensics establish what was accessed and how. Legal assess the notification position. PR drafts holding statements.
5. Day 2–3 — notification decision. If notifiable: file with the Commissioner via the NotifyUs portal,² notify affected individuals as soon as practicable, brief the board / executive team. Sector regulators in parallel.

The cover pays for every consultant, lawyer, forensic specialist, and call-centre operator across that timeline. Without cover, those costs come straight off your operating budget at the worst possible moment.

An illustrative scenario

The same scenario without cover sees the firm fronting that $180K in cash while running the response themselves — usually less effectively, because the specialist relationships are already pre-built into the insurer panel. This is the core economic argument for buying cyber cover before you need it.

What insurers expect before they'll quote

For data-breach exposure specifically, NZ underwriters pay close attention to:

• How much personal data you hold and how it's segmented. A million customer records sitting on one un-segmented file share is a red flag.
• MFA on the systems holding personal data, not just on email.
• Encryption at rest for sensitive customer data.
• Access logging on customer databases — without logs, forensics can't establish scope, and the notification decision defaults to "assume the worst".
• A data retention policy — old data you no longer need is liability without value. Many breach claims involve records the business shouldn't have been holding any more.

Common questions

What to do next

Scope your data exposure: where personal information lives, who can access it, what's logged, and what your retention policy says. Then start the conversation about cover. The 3-step quote takes about 2 minutes; the long-form covers MFA, backups, prior incidents, and the rest in one go. For more on related topics, see our overview of what cyber insurance covers and the cyber insurance glossary.