New Zealand's Office of the Privacy Commissioner received 1,093 privacy breach notifications in the year to 30 June 2025, up 27% on the 864 received in 2023/24, according to its Annual Report 2025. Of the 1,093, 591 were serious. Under the Privacy Act 2020, an agency that has a breach likely to cause serious harm must tell the Commissioner as soon as practical.
How many privacy breaches are notified in New Zealand each year?
In 2024/25 the Commissioner received 1,093 breach notifications from agencies, of which 591 were serious and 502 were not. The two prior years, read from the same report's quarterly chart, were 864 in 2023/24 and 839 in 2022/23. That is a 27% jump in one year, after a nearly flat 2023/24 (839 to 864).
| Year | Total notified | Serious | Not serious |
|---|---|---|---|
| 2022/23 | 839 | 430 | 409 |
| 2023/24 | 864 | 413 | 451 |
| 2024/25 | 1,093 | 591 | 502 |
Source: Office of the Privacy Commissioner, Annual Report 2025, compliance data (summed from the published quarterly chart).
The report does not say why volumes rose. It does note that its enquiries, privacy complaints and breach notifications "have increased significantly" and records a record 1,598 privacy complaints in the same year. Notification is mandatory for serious harm, so a higher count may reflect more incidents, better awareness of the duty, or both.
Notifications rose 27% in a year, and serious ones rose faster than the rest.
How much did serious breach notifications grow?
Serious notifications rose from 413 in 2023/24 to 591 in 2024/25, an increase of about 43% (the Commissioner's own release says 43% too), while non-serious ones grew from 451 to 502, about 11%. Serious breaches made up 54% of everything notified in 2024/25, against 48% in 2023/24.
Figure 1: Split of the 1,093 notifications received in 2024/25 into serious (591) and not serious (502). Source: Office of the Privacy Commissioner, Annual Report 2025.
The growth was not spread evenly through the year. Quarterly serious counts for 2024/25 were 122, 282, 89 and 98, so a single quarter (October to December 2024) accounts for nearly half of the year's serious total. The annual report does not attribute that spike to a cause, so treat it as a fact about timing and not a trend.
Figure 2: Serious and not-serious breach notifications by quarter, 2023/24 and 2024/25. Source: Office of the Privacy Commissioner, Annual Report 2025, quarterly chart.
The 282 serious notifications in the second quarter of 2024/25 is the highest single-quarter figure on the chart, and it is more than double any quarter the year before.
Which sectors report the most serious breaches?
The report's sector chart, titled "Privacy breach notification volumes by Industry", shows 422 private-sector notifications in 2024/25. Its three sector bars sum to 591 in 2024/25 (and to 430 and 413 in the earlier years), which are the serious-notification totals, so the chart appears to cover serious notifications; the report does not label it that way. On that reading the private sector accounts for about 71%. That is up from 181 in 2023/24, when the public sector reported slightly more (187). Public-sector notifications dropped to 131, and non-profits reported 38.
Figure 3: Breach notification volumes by sector, 2022/23 to 2024/25. Source: Office of the Privacy Commissioner, Annual Report 2025. The 2024/25 bars sum to 591, matching the serious-notification total.
The public-sector figure was steady at 182 and 187 in the two earlier years before falling to 131, while the private figure more than doubled in a single year. If you run a small online business in New Zealand or sell to people there, you are in the sector the numbers say is reporting most. For a neighboring regime's numbers, see our figures on Australia's data breach notifications.
On the report's sector chart, the private sector now accounts for roughly seven in ten notifications.
How quickly do agencies report a serious breach?
The Commissioner's guidance expects serious breaches to be notified within 72 hours, and in 2024/25 71% were, up from 60% in 2023/24 and from a baseline of 61% in 2022/23. The Office says part of the improvement came from a series of similar breaches notified promptly by one sector.
The statutory duty itself is looser than the 72-hour guide. The annual report describes it as notifying the Commissioner "as soon as practical" of any breach where it is reasonable to believe an individual could suffer serious harm. The 72 hours is the Commissioner's expectation, not a number in the Act. For how other regimes set their clocks, see our comparison of data breach notification deadlines by country.
Once a serious notification arrives, the Office checks in with the agency. It followed up 95% of serious notifications within 10 working days in 2024/25, against 85% in 2023/24. It dropped its earlier 100% target as "unrealistically high and resource intensive."
Roughly three in ten serious breaches still reach the regulator after the 72-hour mark.
What does New Zealand law require, and what is the penalty?
The Privacy Act 2020 requires a business or organization with a privacy breach that has caused serious harm, or is likely to, to notify the Privacy Commissioner as soon as possible. Failing to notify is an offense, and the Commissioner's information sheets say it can bring a fine of up to $10,000. The agency should also tell affected people as soon as possible.
Figure 4: How a notifiable privacy breach moves from discovery to notification under the Privacy Act 2020, as described by the Office of the Privacy Commissioner. This is a summary of regulator guidance, not legal advice.
Notifications are lodged through the Office's online tool, NotifyUs. Failing to tell affected people is described differently: the Commissioner says it may be an interference with a person's privacy under the Act.
The Commissioner argues that the Act is too soft. The annual report says "the lack of penalties within the Act provides agencies with few financial incentives to take privacy seriously." In a March 2025 survey of more than 1,000 New Zealanders, three quarters considered that the Commissioner should have the power to audit agencies' privacy practices, issue small infringement fines for a privacy breach, and ask the Courts to issue large fines for serious breaches.
The report also notes a Privacy Amendment Bill adding an indirect notification principle, which it described as due to come into force on 1 May 2026. Check the current status with the Commissioner, since this guide relies on figures published before that date.
The fine for staying silent is capped at $10,000, but the cost of an unreported breach lands on the people affected.
The Bottom Line
New Zealand agencies told the Privacy Commissioner about 1,093 breaches in 2024/25, up 27%, with 591 of them serious and, on the Commissioner's sector chart, about 71% of 591 notifications coming from the private sector. Notice is getting faster, with 71% of serious breaches reported within 72 hours, but nearly three in ten still arrive later. The law sets a fine of up to $10,000 for failing to notify, and the regulator is on record asking for stronger penalties. If you hold personal information about people in New Zealand, write down who decides whether a breach is serious, how your team reaches the Commissioner, and what you tell affected people. A clear privacy policy that says how you handle incidents and who to contact helps you meet the transparency side of that duty, though it does not replace the notification process. This article is general information, not legal advice.
Frequently Asked Questions
How many privacy breaches were notified in New Zealand in 2024/25? The Office of the Privacy Commissioner received 1,093 privacy breach notifications in the year to 30 June 2025, up 27% on the 864 notified in 2023/24. Of those, 591 were rated serious and 502 were not.
How fast do New Zealand agencies have to report a serious breach? The Privacy Act 2020 requires notification as soon as practical, and the Commissioner's guidance expects it within 72 hours. In 2024/25, 71% of serious breaches reached the Office within 72 hours, up from 60% in 2023/24.
What is the penalty for not notifying a privacy breach in New Zealand? Failing to notify the Privacy Commissioner of a notifiable privacy breach is an offense that can bring a fine of up to $10,000, according to the Commissioner's Privacy Act 2020 information sheets.
Which sector reports the most serious privacy breaches? The private sector. On the Commissioner's sector chart, whose bars sum to the serious-notification totals, private-sector notifications rose from 181 in 2023/24 to 422 in 2024/25, about 71% of the 591 serious notifications, while the public sector fell from 187 to 131.
Where the Numbers Come From
- Office of the Privacy Commissioner: Privacy Commissioner Annual Report 2025 (year to 30 June 2025). 1,093 total and 591 serious notifications, quarterly and sector charts, 72-hour and 10-working-day measures, 1,598 complaints, the March 2025 public survey. Prior-year totals are summed from the report's own quarterly chart.
- Office of the Privacy Commissioner: Privacy Act 2020 information sheets. Notification duty, offense, fine of up to $10,000, notifying affected people, the NotifyUs tool.
- Office of the Privacy Commissioner: New Zealand needs Privacy Act modernisation (13 November 2025). Confirms the 43% rise in serious breach notifications. The Privacy Act 2020 duties here are described as the Commissioner publishes them, not quoted from the statute.
Note: All figures verified as of November 2026 against the Commissioner's Annual Report 2025. The Office publishes a new annual report each year, so check for the 2025/26 figures when they appear.
