TL;DR: New Zealand’s Cyber Security Strategy 2026–2030 and Action Plan 2026–2027 (released early 2026) ask the Ministry of Justice to advise on two things that matter to ordinary Kiwis: a civil pecuniary penalty regime under the Privacy Act (which currently has no civil fines for poor security), and a new offence for people who view, possess or share personal information they know was illegally obtained. A separate consultation proposed 24-hour early warning and 72-hour full incident reports for critical infrastructure.
What’s in the plan
From MinterEllison (16 March 2026):
| Action | What it would do |
|---|---|
| Action 8: privacy penalties | MoJ to advise on options like a civil pecuniary penalty regime under the Privacy Act 2020 |
| Action 11: stolen data offence | MoJ to advise on an offence for people who view, possess or share personal information they know was illegally obtained |
| Critical infrastructure | Proposed 24-hour early warning and 72-hour full report for incidents in sectors like energy, health, finance, telco, transport and water (consultation 27 Feb–19 Apr 2026) |
Why the stolen data offence matters
After big breaches, stolen data gets posted on leak sites and shared around. Right now, someone downloading and passing on your stolen medical records faces limited consequences. The aim, per the plan, is to deter hackers from posting stolen data online, and to stop it spreading once it’s out.
It’s the digital version of "receiving stolen goods." Overdue, frankly.
Why privacy penalties matter
The Privacy Act has no civil fines for failing to protect personal information. The Privacy Commissioner has been asking for a much stronger penalty regime (details). The article notes the detail "will take the Ministry of Justice time to prepare."
What prompted it
A rough run for NZ health data: the Manage My Health breach and the MediMap tampering, where patients were marked as deceased.
What it means for you today
Nothing changes overnight; these are advice-stage actions. Meanwhile:
- Use your right of access to see what organisations hold.
- Complain if they mishandle it (how).
- Suppress your credit file if ID leaked (how).
A free exposure check shows which breaches your email appears in.
Frequently Asked Questions
Is New Zealand making it a crime to share stolen data?
The Cyber Security Action Plan asks the Ministry of Justice to advise on an offence for viewing, possessing or sharing personal information known to be illegally obtained.
Will the NZ Privacy Act get fines?
The Action Plan asks the Ministry of Justice to advise on options such as a civil pecuniary penalty regime.
What reporting is proposed for critical infrastructure?
A 24-hour early warning and a 72-hour full incident report, under a discussion document consulted on in early 2026.