A recent Privacy Commissioner decision note describes a legal practice that recognised a cybersecurity incident but failed to appreciate that it also needed to assess a privacy breach. It took 6 months to notify the Commissioner and affected individuals.
For practices holding sensitive information about people’s health, employment, criminal history and family circumstances, that is concerning.
What happened
The practice identified unauthorised access to an email account in May 2025. An unknown third party could access sensitive client information, and the practice received forensic findings that month. However, it did not recognise that those findings required an assessment under the Privacy Act.
The practice notified OPC and affected individuals in November 2025. It had no privacy incident response plan, and its office manager, who held responsibility for privacy, had not received adequate training. The notification delay was a central concern in PBN4406 [2026] NZPrivCmr 2.
Securing the account does not resolve the privacy questions
When an organisation discovers an intrusion, it needs technical help to contain it and establish what happened. At the same time, it needs to assess the implications for the people whose information was affected.
That assessment should consider what information someone could access, who may have obtained it, what harm could follow and what steps could reduce that harm. In a legal matter, the context can be particularly significant. Disclosure of a home address, medical report or allegation could affect someone’s safety, employment or family relationships.
A breach is notifiable if it has caused, or is likely to cause, serious harm. The organisation must notify OPC and affected individuals as soon as practicable, subject to statutory exceptions concerning notification to individuals. The decision note explains those obligations.
OPC expects notification within 72 hours of an organisation becoming aware that a breach is notifiable. This is guidance supporting the statutory requirement, rather than a fixed statutory deadline. It does not mean an organisation can wait three days when it could reasonably notify sooner.
An organisation can also update its notification as further information becomes available. It does not need every question answered before making an initial notification. OPC’s guidance on timing explains how this works.
The information lawyers hold warrants care
Law firms can hold extensive medical records, employment histories, criminal allegations and convictions, financial information and detailed accounts of family disputes. Much of that information concerns clients, but it can also concern witnesses, employees, opposing parties and people who have never chosen to engage the practice.
People may disclose information to a lawyer at a particularly difficult point in their lives. They should be able to expect that the lawyer understands how to protect it and what to do if something goes wrong.
In my own work, I too often encounter legal practices without clear privacy policies or notices. I also see access requests met with a response that the Privacy Act does not apply.
It is disappointing to see lawyers overlook obligations that apply to their own practices.
Legal professional privilege may justify withholding particular information. However, it does not create a general exemption from the Privacy Act or remove the need to assess an access request properly. OPC’s guidance on privilege explains the relevant protections.
Generally, an organisation must decide an access request as soon as reasonably practicable and within 20 working days, unless a lawful extension applies. If it refuses access, it must explain the basis and advise the requester of their right to complain to OPC. If it agrees to provide information, it must do so without undue delay. OPC’s access guidance sets out the process.
IPP3A needs to be part of current practice
Since 1 May 2026, Information Privacy Principle 3A has imposed notification obligations when an organisation collects personal information from someone other than the person concerned.
Subject to exceptions, the organisation must take reasonable steps to tell the person about the collection and specified matters, including its purpose and their rights of access and correction. It must do this as soon as reasonably practicable after collection. OPC’s IPP3A guidance explains the requirements.
Legal practices regularly receive information about people from clients, employers, experts and other organisations. They need a process for deciding when to notify someone and whether an exception applies. A general assumption that legal work is exempt will not do.
IPP3A was not the issue in this 2025 incident. It is a separate, current obligation that practices should have addressed.
AI adoption requires a proper privacy review
I’m also concerned about legal practices adopting AI and other technology without sufficiently reviewing the privacy implications, the relevant contracts or what happens to the information they enter.
Before using a tool with personal information, a practice should understand whether the provider can retain that information, disclose it or use it for its own purposes, including model training. OPC recommends a privacy impact assessment before using AI and keeping that assessment updated. Its AI guidance explains how the privacy principles apply.
I recommend reviewing the service contract, any data protection agreement and the product settings together. That review should establish:
Whether the provider can use inputs or outputs for training or other purposes.
Where it stores information and who can access it, including subcontractors.
How long it retains information and what deletion arrangements apply.
How quickly it must report a breach and what assistance it must provide.
Whether the practice can meet access, correction and other privacy obligations when using the service.
The review also needs to consider confidentiality and privilege. A statement that a product is secure does not, by itself, answer these questions.
What organisations can learn
I recommend checking that the person responsible for privacy has the training, authority and support to do the job, and that staff know how to recognise and escalate a possible breach.
A response plan should connect the technical investigation with the privacy assessment. Practising that plan helps establish whether the right people receive the information they need and can make decisions promptly. Record the reasons for notification decisions and revisit them as the facts develop.
Organisations should also review their access request procedures, privacy notices, IPP3A processes and technology contracts. A policy is useful only if the organisation’s actual practices support it.
Specialist advice and independent assessment
Privacy work involves applying the Act to facts that are often incomplete or changing. Regulatory guidance, decision notes and relevant court and Human Rights Review Tribunal decisions help inform that assessment. International developments can also offer useful lessons, although they need to be considered in the New Zealand context.
There is value in involving a privacy lawyer who works with these issues every day. Where a practice is assessing its own breach, external advice also provides an independent perspective on the risk of harm, notification obligations and the adequacy of its response.
At O’Brien Legal, I assist law firms and other organisations with privacy breach assessments, access requests, privacy policies and notices, IPP3A compliance, and reviews of AI and technology arrangements.
If you need help responding to an incident or reviewing your organisation’s privacy practices, please contact me at O’Brien Legal.