Australia’s notifiable data breach scheme, which began last month, could affect New Zealand businesses.

Under the laws, organisations must inform affected individuals if a breach is likely to result in serious harm, and notify the Office of the Australian Information Commissioner.

Claims administrator Gallagher Bassett says the rules also apply to organisations outside Australia if they collect information from individuals within the country.

“A New Zealand company distributing products online is very likely to have customers in Australia,” it says. “If those customers are individuals, the company is almost certainly collecting personal information.”

Gallagher Bassett New Zealand’s Head of Cyber Services Gerard Ward says the costs of a data breach can be covered by cyber insurance. “The direct and indirect costs of a breach could have a significant adverse impact on the affected company,” he said.