- This is general information, not legal advice. Check anything specific with a lawyer or the Privacy Commissioner's guidance.
- Personal information is anything that identifies a person, and most business automations touch some.
- Collect only what you need, tell people why, keep it secure, and delete it when you no longer need it.
- Know where your data is hosted and whether any AI tool uses it for training.
- Privacy breaches that cause, or are likely to cause, serious harm must be reported to the Privacy Commissioner and the people affected as soon as practicable.
Why the Privacy Act 2020 matters when you automate
General information, not legal advice. This guide explains the Privacy Act 2020 in broad terms for small business owners thinking about automation. It doesn't cover every situation. For anything specific to your business, check the guidance from the Office of the Privacy Commissioner or talk to a lawyer.
Picture a Friday afternoon. Your new booking reminders have been running all week and they're working beautifully. Then a customer rings: "Why did I get a text about someone else's appointment?"
A person copying details between systems might make that mistake once. An automation set up wrongly can repeat it many times before anyone notices. Automation doesn't change the rules. It does change the scale. That's why a few privacy questions belong at the start of every automation project, not after.
The Privacy Act 2020 is New Zealand's main privacy law. It sets out how businesses and organisations should collect, store, use and share information about people. It applies to businesses of all sizes, from a sole trader to a large company, and the Office of the Privacy Commissioner is the regulator.
The Act is built around 13 information privacy principles. Together they cover the whole life of personal information:
- Why and how you collect it.
- How you store and protect it.
- People's right to see and correct it.
- How long you keep it.
- When you can use or share it.
It also expects every organisation to have a privacy officer. In a small business that's often the owner or office manager.
What counts as personal information
Personal information is any information about an identifiable individual. The simple test: if you can tell who it's about, it counts.
In a typical small business that includes:
- Customer names, phone numbers, email and street addresses
- Booking history, purchase history and notes about preferences
- Health details in a clinic or salon intake form
- Financial details held by an adviser or accountant
- Staff records, rosters, timesheets and pay details
- Call recordings, voicemails, photos, text messages and emails
Information about a business itself, such as a company's trading name or GST number, is generally not personal information. But a sole trader's details often are, because the business and the person are the same.
Most automations touch at least some of this. Here's how it shows up in everyday tasks:
| Automation | Personal information it uses |
|---|---|
| Booking reminder | A name and phone number |
| Quote drafted from site notes | Often the customer's address |
| File note written from a call | Possibly sensitive details |
None of that stops you automating. It just means you should know where the information goes.
Collect only the personal information you need, and say why
Only collect personal information you have a real business reason for. Automation makes it tempting to capture everything because storage is cheap.
Resist that. Every extra field is something you have to protect, and something that can leak.
A quick test for each form field. What would break if we stopped asking for this? If the answer is nothing, take it off the form.
When you collect information, people should generally know what you're collecting, why, who will see it, and how they can ask to see or correct it. A short privacy statement on your website, booking form or intake form usually covers this.
Watch for new uses. Say you used to only call customers, and your new automation sends reminders by text. That's the information being used in a new way, so check that your privacy statement still covers it.
Keeping personal information secure: storage and access
The Act expects you to keep personal information reasonably safe from loss, misuse and unauthorised access. What's reasonable depends on how sensitive it is.
For most small businesses, the basics go a long way:
- Turn on two-factor authentication. Do it on email, accounting, booking and any tool that holds customer data. It means a password alone isn't enough to get in.
- Give each person their own login. Don't share one, so you can remove access when someone leaves.
- Limit access to what each role needs. A receptionist may need booking details but not clinical notes.
- Keep a list of which tools hold personal information. Note who has access to each. It's also useful when you need to answer a customer's request to see their information.
- Check automations that send messages. Make sure they can't send one customer's details to another.
People also have a right to ask for the personal information you hold about them, and to ask for it to be corrected. If your information is spread across several tools, answering that request is hard.
A well connected set of business apps with one main record per customer makes it much easier.
Where your data is hosted, and sending it overseas
Many cloud tools store data on servers outside New Zealand. That's not automatically a problem, but you remain responsible for the information.
In general terms:
- Storing isn't the same as handing over. Using a cloud provider to store or process information for you is different from handing it to another organisation for its own use. Either way, you remain accountable for it.
- Sharing overseas for their own use has extra rules. If you plan to share personal information with an organisation overseas for its own use, read the Privacy Commissioner's guidance first, because extra rules apply.
- Read the provider's terms. See where data is stored, who can access it and what happens to it if you leave.
Choosing tools hosted in New Zealand or Australia often makes these questions simpler.
How we handle it. When we build automations, client data is handled under the Privacy Act 2020, and the data we store is hosted in New Zealand or Australia. Automations are built in your own accounts, so you keep control of them and keep everything if you stop working with us. Only Ambs works on client projects and sees client data; we don't use contractors.
Other tools in the chain, such as your accounting or email software, have their own hosting. So they belong on your checklist too.
AI tools and training data: what to check first
AI tools raise one extra question: does the provider use what you send it to train its models?
With some free or consumer versions, it may. With many business versions there are settings or terms that keep your data out of training. But you need to check rather than assume.
Before you put customer or staff information into an AI tool, find out:
- Is our data used for training? Get the answer from the provider's terms or settings, not from a sales page.
- Where is it processed and stored? And for how long?
- Who at the provider can see it? And under what circumstances?
- Do we need to send personal details at all? Often an AI reply or summary works just as well with names and contact details removed.
- Who checks the output? AI can get facts wrong. Anything sent to a customer, or used to make a decision about a person, should be checked by someone.
The data we handle for clients is never used to train anyone's AI model. The AI tools we use on client data run on business plans that don't train on that data.
Thinking about AI for customer messages? Our guide to AI customer replies for small business covers how to keep a person in the loop.
How long to keep it: retention and deletion
Don't keep personal information for longer than you need it for the purpose you collected it. Automation tends to keep everything forever by default, so set a rule and build it in.
Balance this against other obligations. For example, businesses generally need to keep business records for seven years for tax purposes. Your accountant can tell you which records that covers.
Good candidates for scheduled deletion are often:
- Old enquiry forms
- Expired leads
- Copies of ID that were only needed once
Remember the copies. An enquiry form might be saved in your website, emailed to two inboxes and copied into a spreadsheet. Deleting one leaves three.
When something goes wrong: privacy breaches
A privacy breach is unauthorised or accidental access to, or disclosure, change, loss or destruction of, personal information.
It's often more ordinary than it sounds. An email sent to the wrong customer, a lost laptop or a hacked inbox can all be breaches.
If a breach has caused, or is likely to cause, serious harm to someone, the Act requires you to notify the Privacy Commissioner and the affected people, as soon as practicable. The Privacy Commissioner's website explains how to assess harm and how to report.
Plan for mistakes before they happen. Know who decides whether a breach is serious, how you'll contain it, and where you'll record what happened. A little planning now can save a stressful afternoon later.
A privacy checklist before you automate
Run through these questions for any automation that touches personal information. Still deciding which task to start with? Our guide on choosing what to automate first can help.
- What personal information does this automation use, and do we need all of it?
- Does our privacy statement cover this use?
- Which tools will the information pass through, and where is each one hosted?
- Who will be able to see it, and is two-factor authentication on for each tool?
- Does any AI tool in the chain use our data for training?
- Could it send one person's information to someone else? How would we notice?
- How long will the information be kept, and in how many places?
- Who is responsible for this automation, and who do they call if something goes wrong?
If you can answer these clearly, you're in a good position. If several are unclear, that's a sign to tidy up the process before you automate it.
Come across a term you're not sure about? Our automation glossary explains them simply.
Common questions
Does the Privacy Act 2020 apply to my small business?
Generally, yes. The Act applies to businesses and organisations of all sizes in New Zealand, including sole traders, when they collect and use personal information. If you are unsure how it applies to you, check the Privacy Commissioner's guidance or talk to a lawyer.
Can I use AI tools with customer information?
You can, but check first how the tool stores the information, where it is hosted, who can see it and whether it is used to train the provider's AI model. Many business plans offer settings that keep your data out of training, and you should confirm this in writing before sending personal information.
Is it a problem if my data is stored overseas?
Not automatically. Many cloud tools store data overseas. You stay responsible for the information, so check where it is held and how the provider protects it. The Privacy Commissioner's guidance covers sending information overseas in more detail, and choosing tools that host in New Zealand or Australia can make these questions simpler.
What should I do if an automation sends personal information to the wrong person?
Act quickly to contain it, such as asking the recipient to delete it and fixing the cause. Then assess whether it could cause serious harm. If it has or is likely to, you must notify the Privacy Commissioner and the affected people as soon as practicable. Keep a record of what happened either way.