Lead signal
The Manage My Health final report turns dormant accounts and breach response into findings, and the Commissioner says every agency should take note. Indirect collection rules have applied since May, so third-party data collected since then is already in scope.
Regulatory changes on the radar
Show radar
Regulatory radar overview
Select a numbered signal to read its detail. Size and colour show severity.
Zoom and drag to explore. The radar stays open until you hide it.
Indirect collection rules started in May
- Who it affects
- any agency collecting personal information about people from someone other than the person
- What it can disrupt
- data feeds from third parties that never trigger a notice to the person they describe
- Why it matters now
- Applies to personal information collected since 1 May 2026. Everything collected indirectly since then is already in scope.
Dormant accounts became a breach finding
- Who it affects
- any agency running customer accounts, portals or apps
- What it can disrupt
- customer platforms with no process to check in on, close or purge accounts nobody uses
- Why it matters now
- Final report released 30 October. The Commissioner generally expects a check-in after 12 months of inactivity.
Breach notified six months late
- Who it affects
- any agency whose security incidents are handled by IT or an outside provider
- What it can disrupt
- incident response that treats cyber and privacy separately, so nobody asks whether to notify
- Why it matters now
- Decision published. The Commissioner expects notification within 72 hours of knowing a breach is notifiable.
Overseas policy, New Zealand problem
- Who it affects
- New Zealand businesses using a parent company's privacy policy
- What it can disrupt
- collection notices and privacy policies inherited from a parent company that cite foreign law
- Why it matters now
- Decision published. The Commissioner signals targeted adverse comment, including to parent companies, when firms do not engage.
Personal emails on work systems count
- Who it affects
- any employer responding to access requests from staff or former staff
- What it can disrupt
- access-request processes that skip personal email held in company mailboxes
- Why it matters now
- Case note published. Personal emails held on work systems can fall inside an access request.
Boards must know where AI runs
- Who it affects
- privacy and security teams at regulated financial firms
- What it can disrupt
- AI use nobody has inventoried: vendor features, staff tools and code assistants outside the risk register
- Why it matters now
- Expectations already published. Boards and senior managers should know where AI is deployed and who owns the risk.
Compiled with care from public sources; errors and omissions excepted. Always check the linked source before acting. Regulatory Radar is general information, not legal or compliance advice.