On January 1, 2026, ManageMyHealth notified the Office of the Privacy Commissioner that its patient portal had been breached. The Privacy Commissioner opened an inquiry on January 21, 2026. Phase one findings, released on May 27, 2026, put the number of affected patients at 99,416. The ManageMyHealth breach is the most significant NZ privacy breach investigation opened in 2026, and it illustrates precisely what the Privacy Commissioner examines when a notifiable breach notification arrives.
Not the breach itself. What the organisation did before it.
What counts as reasonable is established by the organisation and, following a complaint or a breach, has to be demonstrated by it. The Privacy Act 2020's Information Privacy Principle 5 requires reasonable security safeguards without naming a specific standard. The organisation decides what reasonable looks like. The Privacy Commissioner decides, in hindsight, whether it was.
That hindsight standard is why penetration testing exists as a compliance practice. It is not a box to tick before an audit. It is the evidence that shows the organisation actively looked for vulnerabilities before an attacker did, found what was findable, and fixed what was found.
What IPP 5 Actually Requires
Information Privacy Principle 5 requires that personal information is protected by such security safeguards as are reasonable in the circumstances to take, against loss, access, use, modification, or disclosure that is not authorised by the agency, and other misuse.
There will be a higher bar for what is considered reasonable if the information to be protected is sensitive. The Privacy Commissioner has emphasised that agencies who handle sensitive data need to apply a higher standard of care. For NZ healthtech, fintech, insurance, and professional services organisations, the sensitivity of the personal information they hold raises the standard they must meet.
Possible safeguards include managed user access, endpoint and email protection, monitoring, tested backups, staff awareness, and vulnerability management. The aim is a proportionate set of safeguards that addresses assessed risks and stays under review. The key word is proportionate. A startup handling only contact form submissions faces a different proportionality test than a patient portal holding health records for hundreds of thousands of New Zealanders.
How a Penetration Test Functions as IPP 5 Evidence
The Privacy Commissioner's investigation following a breach asks a specific question: did the organisation take reasonable steps to identify and address the security vulnerabilities in the systems holding personal information?
A penetration test report answers that question with evidence. It shows:
1. Independent Adversarial Validation
That the organisation commissioned independent, adversarial testing of the systems holding personal information. Not a self-assessment. Not a scan. An active test by a qualified external tester attempting to exploit vulnerabilities the way an attacker would.
2. Prioritised Remediation Guidance
That findings were documented, prioritised, and communicated to the engineering team with actionable remediation guidance.
3. Verified Retesting and Closure
That remediated findings were retested and confirmed closed. The OPC guidance explicitly states that this includes periodically reviewing penetration testing summaries and security certifications as part of demonstrating reasonable security safeguards.
A penetration test that produced findings that were never remediated is not compliance evidence. It is evidence of identified vulnerabilities the organisation chose not to fix. The guide to what happens after a penetration test covers the retest artefacts that a regulator checks after a breach investigation.
Can You Demonstrate Reasonable Security Steps Under IPP 5?
Build defensible, contemporaneous security evidence with CREST-accredited penetration testing and verified retest certificates tailored to New Zealand organisations.
The Privacy Commissioner's Enforcement Direction Is Getting Stronger
On June 3, 2026, the Privacy Commissioner asked the government for powers to impose serious financial penalties. The current maximum fine for failing to notify a notifiable breach is NZ$10,000 per offence. The Commissioner's request signals that the enforcement landscape for NZ organisations is moving in the same direction as Australia and the EU: toward penalties that reflect the scale of breaches rather than a fixed statutory cap.
An agency that fails to notify the Privacy Commissioner of a notifiable breach commits an offence, and fixing the breach afterwards is not a defence. The Act provides a defence where the agency reasonably considered the breach was not notifiable, which makes a contemporaneous, evidence-based assessment important.
A contemporaneous, evidence-based assessment means documentation that existed before the breach. A penetration test report from three months before the incident, with a remediation record and a confirmed retest, is the strongest form of contemporaneous evidence. It shows the organisation assessed its security posture, identified risks, and took documented action.
The Privacy Commissioner expects notification within 72 hours of discovering a notifiable breach, even where the investigation is incomplete. Organisations that maintain continuous testing evidence can respond within that window with a clear picture of their security posture. The guide to penetration testing frequency and how often to test in 2026 covers the cadence that produces auditable evidence for each compliance cycle.
Book a scoping consultation with Capture The Bug to confirm the penetration testing programme your NZ organisation needs to satisfy the Privacy Act 2020 reasonable steps standard.
Frequently Asked Questions
What does IPP 5 of the NZ Privacy Act require for security?
Information Privacy Principle 5 of the Privacy Act 2020 requires every agency to protect personal information with security safeguards that are reasonable in the circumstances. The safeguards must protect against loss, unauthorised access, use, modification, or disclosure. What counts as reasonable is determined by the organisation and, following a complaint or a breach, must be demonstrated to the Privacy Commissioner. The standard is higher for sensitive data such as health information, financial records, or identity documents. Safeguards include access management, encryption, monitoring, vulnerability management, and penetration testing. The aim is a proportionate set of safeguards that addresses assessed risks and stays under review.
Does penetration testing satisfy the NZ Privacy Act IPP 5 requirement?
Penetration testing is strong evidence that an organisation took reasonable steps under IPP 5, but only when the findings were remediated and retested. A penetration test that produced documented findings demonstrates that independent adversarial testing was conducted. A retest report confirming findings were closed demonstrates that identified vulnerabilities were actually addressed. The Office of the Privacy Commissioner's guidance explicitly references periodic penetration testing summaries as part of demonstrating reasonable security safeguards. A test without a remediation record is incomplete compliance evidence.
What does the Privacy Commissioner examine when investigating a breach?
Following a notifiable breach, the Privacy Commissioner examines whether the organisation took reasonable steps to protect the personal information involved. This includes what security testing was conducted and when, whether findings were remediated, whether the breach occurred through a known or previously untested vulnerability, and whether the organisation's security posture was proportionate to the sensitivity of the information held. A penetration test report with a remediation and retest record is the specific documentary evidence that addresses these questions.
What was the ManageMyHealth breach and why does it matter for NZ compliance?
ManageMyHealth notified the Office of the Privacy Commissioner on January 1, 2026 that its patient portal had been breached. The Privacy Commissioner opened an inquiry on January 21, 2026. Phase one findings, released on May 27, 2026, confirmed 99,416 patients were affected. The breach is the most significant NZ privacy breach investigation opened in 2026 and illustrates what a Privacy Commissioner investigation looks like in practice: what the organisation did before the breach, whether reasonable security steps were taken, and what evidence the organisation can produce to demonstrate those steps.
How often should NZ organisations run penetration tests to satisfy IPP 5?
The Privacy Act does not specify a testing frequency. Reasonableness under IPP 5 depends on the sensitivity of data held and the rate at which systems change. For NZ organisations handling health information, financial data, or identity documents, annual testing is the minimum baseline expected by the Privacy Commissioner. Organisations with active development cycles, API integrations, or cloud migrations should test more frequently and after significant system changes. A continuous evidence trail across each compliance period is stronger than an annual-only test, because it demonstrates ongoing attention to security posture rather than a single point-in-time check.
