Our website uses cookies so we can analyse our site usage and give you the best experience. Click "Accept" if you’re happy with this, or click "More" for information about cookies on our site, how to opt out, and how to disable cookies altogether.
We respect your Do Not Track preference.
Security of information and IT infrastructure is a critical component of a robust privacy programme. Both security and privacy staff must work together to identify external and internal risks, and to ensure that security is prioritised and resourced accordingly.
Cyber-attacks are on the rise and being able to respond appropriately to them is a key responsibility for organisations. You can read more about planning for, and practicing, incident response plans in our Breach Management guidance.
Organisations must take reasonable steps to make sure the information they hold is kept safe and secure. This includes making sure it’s protected from loss, accidental or unauthorised disclosure, access, use, or modification or any other misuse. This obligation applies to information that is held by the organisation (for example, in on-premises servers) and information that is held on the organisation’s behalf by a service provider (for example, a cloud-based data storage provider). Remember, organisations are liable under the Privacy Act for the personal information stored and processed on their behalf.
The most effective strategy is having a well-thought-out security plan for all personal information you hold.
At a high level, this pou describes key security controls across three areas – physical, technical, and organisational.
These controls are not exhaustive and are continually evolving. Organisations need to ensure that they update their knowledge on security risks, including seeking advice from external experts where necessary, and implement all reasonable security safeguards in a timely way.
Providing security and IT advice is not a core function of OPC, therefore we have provided links to advice and resources from other authoritative sources, such as CERT NZ, and others.
Keeping information secure isn’t just about having encrypted databases, it also includes physical security, operational security, security during transmission and during destruction.
The guidance below covers some of the most common practices that can lead to data and privacy breaches if not appropriately monitored and managed within your organisation.
The controls available to you in these scenarios can be categorised as:
Often, you will need to use a combination of controls from all three categories to ensure you have a robust security system in place to reduce the likelihood of breaches.
What steps are appropriate will depend entirely on the context of your organisation, including:
Organisations have an obligation to store personal information securely. System errors, scams, and employee browsing can all lead to a security failure.
A secure IT network will help protect the personal information your organisation works with from hacks, viruses, and malware. CERT NZ(external link) has produced cybersecurity guidance that will help you keep personal information safe in your network.
Organisations must not keep personal information for longer than they need it. If your organisation doesn’t have a specific legitimate purpose for keeping the personal information, it must be disposed of securely, whether it is in physical or digital form.
Public sector organisations have obligations to preserve records under the Public Records Act. You can find guidance on this at Manage information – Archives New Zealand(external link).
Your organisation is responsible for working out when personal information is no longer needed, as well as a practical solution for disposing of physical documents containing personal information. For example, shredding can be an effective way to dispose of paper records and photographs.
You should also securely delete personal information before you reuse or dispose of any electronic equipment such as computers and laptops, smartphones, tablets, hard drives, USB sticks, photocopiers, and cameras.
You can read more about retention and disposal in the Know your Personal Information pou.
Organisations have an obligation to prevent their employees from inappropriately accessing and/or disclosing customer information. Where employees access customer information without a legitimate business purpose, this is called employee browsing.
Employee browsing or internal misuse of personal information is one of the most common privacy breaches, yet it is poorly understood as a breach, which is why it has been included specifically in this pou. These types of breaches risk staff and customers losing trust in your organisation and can cause serious harm to the individuals whose privacy has been breached.
In one example, a person in a position of power looked up the details of a colleague’s partner then used their position to repeatedly sexually harass the partner via text message. The victim felt intimidated, scared, and fearful in their own home so contacted OPC.
Remember, organisational controls are only effective if staff are reminded of their existence.
We’ve included some use cases based on fictional organisations to demonstrate each of the pou in practice. Read more of the background on our Organisation Examples page.
Fern Leaf has a well-established IT team. The privacy team recognises the IT team’s expertise in this area and so have jointly worked on implementing physical, technical, and organisational controls. As part of its work, the IT team sends out phishing exercises to ensure employees remain aware of these types of attacks.
Prior to using software, the IT team ensure that they carry out due diligence on third parties including checking what security credentials they hold.
Senior leadership have zero tolerance for employee browsing and trust that their employees will not go snooping, as their customers don’t want to be ringing up and not receive help due to access being too restrictive. They send out regular communications on this and have noticed a reduction in employee browsing cases. They actively carry out random checks to ensure those who are accessing customer profiles have a legitimate business purpose. Their zero-tolerance approach is reflected in their code of conduct and forms part of staff inductions. There have been repercussions for staff who have been found to be inappropriately accessing customer profiles.
Reach High does not have an internal IT security resource, and so it relies strongly on service providers to deliver its security capability. It addresses this in the following ways, noting that it has already identified that it has a high privacy risk profile:
Security of customer information is crucial to Swiftstart NZ’s success as a company. While it doesn’t have a dedicated security or IT function, as a tech-savvy digital organisation, all staff have some responsibility for managing security risk. Staff have received training on this and are covered by contracts which clearly set out their responsibilities. In particular, there is a clear expectation on staff around when and how they are permitted to access client customer information, and they know that any inappropriate access will be considered serious misconduct and is grounds for dismissal.
Swiftstart NZ has designed its platform to meet best practice from the outset; it uses encryption to protect the data in transit and at rest, firewalls to prevent unauthorized network access, access controls to limit who can view or modify the data, backups to restore the data in case of disaster, audits to check the compliance and effectiveness of the security measures, and monitoring to detect and respond to any security incidents.
Green Gardens doesn’t have a dedicated security or IT function, due to its small size and low privacy risk profile. However, all staff have some responsibility for managing security risk.
The owner/manager and administrator have joint responsibility for the home office that Green Gardens operates out of. For example, any physical documents containing client personal information are stored in a filing cabinet that is locked outside of business hours, and only the owner/manager and administrator have a key to the cabinet. The onsite computer is password protected, and access is limited to the owner/manager and administrator.
There is a clear expectation of staff for when and how they are permitted to access client information, and they are aware that any inappropriate access will be considered serious misconduct.
As an independent contractor, Jo Jones doesn’t have a dedicated security or IT function, but she is still responsible for managing any security risks to the personal information she holds. Jo Jones has a dedicated work device that is password protected, which is stored in her home outside of her business hours. Jo makes sure the computer operating system of her work device is kept up to date to avoid system vulnerabilities, as well as her device software.
When Jo is working for community health service providers, she has access to their systems via a password-protected account and can only access their systems when she is onsite at one of their offices or clinics. Jo is aware of each health provider’s policies regarding employee browsing and understands that any inappropriate access to personal information will be considered serious misconduct and grounds for dismissal.
Like Fern Leaf, the Ministry has a well-established IT team, and good relationships between IT, information management, and privacy teams. This joined up approach has enabled them to implement robust physical, technical and organisational controls. The Ministry has developed a long-term plan for updating their existing legacy systems, which has been reviewed by the governance function and approved by the Senior Leadership team.
The Privacy team has taken a particular focus on ensuring that staff who are working from home know how to do so safely and that technical and organisational controls persist for those who are working remotely, even in the absence of the Office’s physical controls.
They also recently ran an awareness campaign during Privacy Week about employee browsing, reminding employees of the code of conduct and the Ministry’s zero-tolerance policy. The Ministry undertakes regular spot audits to monitor employee access to files in their older legacy systems that don’t have automated audit logs.
