What should I do if I find or receive someone else's personal information?

People sometimes have information sent to them that's not theirs, or they may find other people's information in places like cafes or on public transport.

One example might be finding a memory stick on the street that contains documents or images. Or perhaps you requested personal information about yourself from an organisation or business and were sent someone else’s file in error.

If this happens to you, you should treat the information like the valuable lost property it is. You have legal obligations once you are in possession of information that identifies other people, or that is clearly confidential.

There are a few things to bear in mind:

1. Remember to keep the information safe and don't copy it. Once you have it, you're responsible for its security.
2. If possible, send it back to the organisation it came from. Then the organisation knows it has made a mistake and can decide whether and how to let the person know. It can also figure out what went wrong so it can improve its systems.
3. Sometimes people want to head straight to the media and share the news of what’s happened. That decision is up to you, but you still have a legal responsibility for the information you hold. Handle the information with respect and send it back to the organisation. There is nothing to stop you telling your story to a journalist. But don’t put other people at risk when you are doing that.

We have privacy breach guidelines to help organisations and businesses plan for what they'll do if they have a breach, and to help them deal with breaches when they occur. 

If you have found another person’s information and are unsure about what to do, get in touch with us. Our free phone number is 0800 803 909 or email us on: enquiries@privacy.org.nz