AM Edition: Top 10 Business Articles on LiveNews.co.nz for March 23, 2026 – Full Text

MIL OSI

Source: Media Outreach

HONG KONG SAR – Media OutReach Newswire – 19 March 2026 – In 2026, KCM Trade proudly celebrates its 10th anniversary — a significant milestone made possible by the continued trust and support of its valued clients. To mark this special occasion, the company has announced its sponsorship of a premium sailing event in Sydney.

In partnership with the renowned yacht charter company Sydney by Sail, the event is themed “2026 KCM Trade Sailing Sydney | A Decade of Progress, A New Chapter Ahead.” Designed as an exclusive celebration at sea, the private sailing gathering will bring together distinguished clients for an unforgettable experience that seamlessly blends festivity with meaningful connection.

Premium Yachts and an Elegant Atmosphere

To honour the occasion, KCM Trade has carefully selected high-specification sailing yachts renowned for their exceptional performance and superior comfort. Thoughtfully designed to balance elegance with practicality, each vessel is fully equipped with premium leisure amenities and comprehensive onboard facilities.

Set against the crystal-clear waters and expansive blue skies of Sydney, guests will enjoy the gentle sea breeze and the sight of graceful sails while engaging in relaxed conversation. The refined yet natural setting creates the ideal environment to strengthen relationships and foster deeper connections.

A Decade of Dedication and Industry Recognition

Since its establishment, KCM Trade has remained committed to professionalism, with innovation at the heart of its development. Over the past ten years, the company has steadily expanded its presence across the global financial markets, earning widespread recognition for its quality products and services, cutting-edge technological infrastructure, and comprehensive client protection.

Throughout this journey, KCM Trade has launched proprietary intelligent trading tools and actively supported a range of financial education initiatives, strengthening its brand influence while fulfilling its corporate social responsibilities.

Advancing Together Towards the Future

This sailing event not only reflects the achievements of KCM Trade’s first decade but also serves as an important opportunity to deepen client relationships and look ahead to the future together.

Moving forward, KCM Trade will continue to uphold its win–win philosophy, delivering enhanced services, forward-thinking innovation, and unwavering commitment. Together with its clients, the company will confidently navigate the evolving industry landscape and craft the next chapter of shared success.

https://www.linkedin.com/company/kcmtrade-global/
https://x.com/kcmtradenigeria?s=21
https://www.facebook.com/share/1Hg7xa9Js2/?mibextid=wwXIfr
https://www.instagram.com/kcm_trade_global?igsh=MTJ5Y2QydmJxY2Ziag==

Hashtag: #KCMTrade #kcmtrade10yrs #Globalbrokers #Sponsor #Sailing

The issuer is solely responsible for the content of this announcement.

– Published and distributed with permission of Media-Outreach.com.

Source: Radio New Zealand

Health New Zealand (HNZ) has been warned that keeping financial control is “one of the thorniest” aspects of the government’s rapid push to devolution.

The government blamed loss of financial control when it sacked the central agency’s board two years ago.

Health Minister Simeon Brown on Tuesday promised regions and districts would get more say over budgets and hiring from 1 July so that decisions on medical care were made closer to the patient.

Late last year he ordered HNZ to decentralise rapidly, and this week he said, “This is the most significant structural change our government is making to improve how the health system operates.”

But the latest HNZ internal report on devolution said “people capability is an extreme risk” in the finance and operations area, with centralisation diverting resources.

“Many local teams are under-resourced in financial management,” said the report done in January for a new devolution committee.

Brown on Wednesday said there was a “huge” amount of work underway to build back the local leadership disempowered by over-centralisation.

“We are making sure we’ve got the capability around operations, around finance, human resources, all of those things are being looked at.”

The January report by consultants Deloitte laid that out, he said.

The report has not been publicly released though RNZ has seen parts of it.

‘Clearly underpowered’

Former HNZ Te Whatu Ora board chair Rob Campbell expressed serious misgivings.

“They quickly need to get some financial resources into those regions and districts which are clearly underpowered in this respect,” Campbell said on Wednesday. “That’s the first thing they have to do.”

The devolution plan puts executive regional directors in charge of rebuilding the capability but at a time when money was exceedingly tight said the report.

“The financial challenges are going to increase in 2026/27, meaning there will be even more pressure on financial controls to reduce the deficit …. from $200m to breakeven.

“Currently there will be little to no capacity remaining within the baseline next year without significant productivity improvements and prioritisation decisions,” it said.

Campbell said it was an unenviable task.

“They’re being told they’re getting more autonomy. The truth is they’re really not, and they don’t have the money to do that anyway.”

‘Fully coming into effect’ on 1 July

The devolution report contains self-assessments by Health NZ’s various business units showing some progress, and a lot of risks, around devolving key clinical and service decisions back to the four health regions and 20 districts.

One section on “reduced financial visibility” said, “One of the thorniest aspects of devolution is financial control – ‘who holds the purse strings’ and how to prevent overspending or inequities.”

Financial visibility was fragmented across 20 health boards before 2022’s centralisation, then smeared after it by “confusion … and weak controls” at Health NZ Te Whatu Ora. It then began its nosedive towards a forecast billion-dollar-plus deficit.

The centralisation also pulled experience and skills into the centre in Wellington, the report said.

This was compounded by hundreds of cuts to support jobs since 2024 in a savings drive.

The January report outlined “critical” current gaps and “staff churn” in the workforce, such as in data and digital, analysis and finance, that supports the frontline doctors and nurses.

Under a heading ‘Options to accelerate devolution’ it said, “There is a risk of not understanding cost structures or nuances between districts, further compounding the risk that pushing the funding allocation and management of each region and district to the lower levels quickly may result in loss of financial visibility across the sector again.”

It said some fixes might take 18 months to three years.

However, Brown said on Tuesday the changes underway would “ensure a nationally planned, locally and regionally delivered health system, will come into effect on 1 July”.

Hospitals would be able to recruit and deploy staff without central sign-off but with delegated budgets and responsibility to meet targets in the district or region.

On Wednesday Brown reiterated the 1 July delivery date.

The Deloitte report talked about the many initiatives being done by HNZ “to make sure that districts and regions are ready for 1 July when the devolved operating model … is fully coming into effect”, he said.

“Of course there’s risks in changing an operating model but at the same time the last government … left local clinicians not able to make some of the key decisions.”

Globally, health ran better when a devolved operating model split decision-making between national, regional and local levels, Brown said.

New policy on who decides what

The devolution plan depended on four executive regional directors at the top being “best placed to manage performance and build capability, which can vary significantly between districts”.

Already, a new policy on who gets to decide on hiring and firing, and on spending, was being rolled out.

Papers RNZ has seen showed the policy was approved by the board in December.

They showed there must be consultation with the regional or national head of human resources for all hires, or for creating new positions within budget; and to create any new positions outside budget needed “consultation/approval” from either of these heads or from the executive leadership team.

Campbell said, “You start off looking like they’ve got a lot of power, and then when you really read through it, they don’t.

“Even on items that are within budget and full-time equivalent allocations, there is a need for … consultation, and in a hierarchical organisation like this consultation means getting approval.”

The biggest difference was a bigger regional element compared to what HNZ was building at the time he was sacked in 2023 for a political attack on National’s water infrastructure policy.

Yet it was “still very tightly controlled” and regional and district managers were “in a no-win situation”, Campbell said.

‘Divergent approaches’

In addition to lack of finance staff, the January report added “fragmentation” to the hurdles for devolution.

“Without strong governance structures and clear national guardrails, regions and districts risk adopting divergent approaches, weakening system-wide alignment and equity in service delivery,” it said.

Those governance structures were still being set up.

Campbell said good governance meant having a business model everyone grasped. “People throughout the organisation still find it very hard to understand what the responsibility for particular issues is.”

The report said Health NZ had had to build national financial guardrails after its lurch towards a big deficit.

“If HNZ devolves too quickly or carelessly, they risk losing the opportunity to use its current … structure and scale” to address system problems, it said.

On the plus side, devolution could help districts take more responsibility for day-to-day spending and not expect topdown bailouts, citing how Australian state hospitals used to have a “rollercoaster of budget blowouts and rescues”.

Brown’s plan retained the Wellington-based bureaucracy for strategy, planning, policies, standards and system integration.

However, the report said many of the national plans existed in name but “have not yet been developed or published, and the decision-making framework to support accountability is still developing”.

Building districts’ financial capability an ongoing focus – HNZ

Late on Wednesday Health New Zealand told RNZ that according to the Deloitte report the agency’s budgeting, planning, reporting, and performance management disciplines had been strengthened since a review of financial management at the end of 2024.

“These improvements have ‘reduced the risk of a loss of financial control levers’,” it quoted.

Building financial capability of districts and regions was an ongoing focus, said executive national director of strategy performance improvement, Jess Smaling.

“Regions and districts will have clear budgets, and delegated authority to make decisions based on the unique local needs,” she said in a statement.

“Budgets will be based on expected activity to meet those local needs, within the resources available to Health New Zealand.”

A national funding board and human resources oversight committee had been replaced by four regional investment committees and “people and culture committees”, along with a national version of that to consider human resource policies so there was national consistency.

A new national investment committee would make funding decisions above the authority of the four executive regional directors.

“Hiring decisions will be made in the regions and districts, within available budgets,” said Smaling.

Those within existing FTE and budget would only require the approval of the hiring manager’s immediate manager.

Decision-makers using delegated authority had to stay within approved budgets and limits, and comply with Health NZ policies and legislation, she added.

Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.

– Published by EveningReport.nz and AsiaPacificReport.nz, see: MIL OSI in partnership with Radio New Zealand

Source: Radio New Zealand

The Government Communications Security Bureau (GCSB) spy agency has taken six times longer than it should have to address questions about lax cyber security identified in a Treasury report.

The report last year mentioned that government data was “being managed or held by unvetted third parties”.

It gave no details, so RNZ sought them.

Director-general Andrew Clark apologised for taking 120 working days to respond, instead of the statutory 20 under the Official Information Act (OIA).

He then refused to answer virtually all of the dozen questions.

Clark said they had to keep incidents and vulnerabilities confidential or people would not share with them, and they needed that information to counter threats.

The Treasury report said government agencies had continued to raise concerns about the security of third-party vendors’ products and services, including poor security controls and unpatched software.

“Some agencies reported that vendors had offshored some services without their prior approval, meaning government data was being managed or held by unvetted third parties,” said the quarterly investment report for the three months to December 2024. Such reports are released publicly many months after they are done.

New Zealand’s small size as a market was biting it, the report suggested.

“Agencies assess that poor service delivery is likely driven by lower competition and less resourcing for comparably smaller contracts in New Zealand versus larger markets,” it said, under the title ‘Other emerging … issues’.

“Low competition, coupled with poor service delivery from some vendors, has also led to high reliance by many Government agencies on the same few vendors, which creates risk to service delivery across the public sector should those vendors suffer a cyber security incident or event.”

Many government agencies had become increasingly reliant on cloud-computing services from US Big Tech companies.

RNZ asked the GCSB, National Cyber Security Centre and Internal Affairs who the problem vendors were. Clark in his response would not name them or say anything about them.

“Providing this information would likely have commercial implications for these vendors” so that was refused on the grounds of unreasonably prejudicing someone’s position.

What about the government agencies that had raised the alarm?

“I am refusing those parts of your request where you have asked for information that has been provided to the GCSB in confidence by agencies,” was the reply, otherwise it might prejudice the supply of such info in future.

The unvetted third parties were not disclosed, and neither were the risks to service delivery that Treasury had told ministers were in play.

The risks information was refused on the grounds the GCSB “does not hold this information in the manner or format you have requested”.

Work was underway on digital investment and procurement, Clark said.

Asked what measures were taken, he said the National Cyber Security Centre provided a range of advice, and they had recently developed “minimum cyber security standards” to focus on the basics and encourage good practices.

The subsequent three quarterly reports after this one did not mention the threat again.

But other weaknesses did come up in them, and in one case Treasury was called out for them, in the latest quarterly report, to September 2025.

It said many data and digital projects did not include information relating to cyber security management or improvement.

It went on to fault the Treasury’s investment management system because it did not recognise the ongoing cost of cyber security, “making it difficult” to upgrade old systems and move away from on-site hardware to ‘as-a-service’ tech “which we know deliver better security results”.

“The current financing rules and settings around capital and operating expenditure are preventing agencies from modernising and improving their cyber security.”

Agencies’ approach to procuring IT systems or services was called “outdated and fragmented” by the government chief digital officer in the September quarterly report, six years after Treasury told the public sector to take an all-of-government approach to try to cut the IT upgrade bill of multi-billions of dollars.

The long wait for the response to the OIA request was put down by the GCSB to consultation and the “volume of information requested” by RNZ.

Most of Clark’s three-page response was taken up outlining the grounds for refusing the information.

RNZ asked for any report that focused on the threat, but did not get one.

Clark apologised for the wait.

“Our response … did not meet the statutory deadline and I do apologise for that. Thank you for your patience while we completed our response.”

Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.

– Published by EveningReport.nz and AsiaPacificReport.nz, see: MIL OSI in partnership with Radio New Zealand

Source: Auckland Council

MIL OSI

Source: Radio New Zealand

Higher fuel costs mean higher transport costs, and that means higher prices across the board – and that’s a hard pill to swallow for Kiwis three years into a cost-of-living crisis.

Kiwis are already feeling the expensive ripple effects of the war in Iran – and economists are warning that the real impact is only just beginning.

What started as a distant geopolitical conflict has quickly landed squarely on our country’s economy, driving up fuel costs, squeezing household budgets, and threatening to slow growth.

If it continues, New Zealand could be staring down the barrel of another recession.

“So this sort of shock, if it gets worse, will definitely increase the risk of a recession here,” Kiwibank chief economist Jarrod Kerr tells The Detail.

“And we have only just gotten out of recession, so to fall back in would be horrendous for households and businesses.”

At the centre of the crisis is oil.

Global prices have surged past US$100 a barrel as fighting disrupts supply routes through the Strait of Hormuz – a chokepoint for about 20 percent of the world’s oil.

And for New Zealand, which imports almost all of its fuel, the effect has been immediate.

Petrol prices are already climbing rapidly, with forecasts that they could push toward $4 a litre – or higher – if the conflict escalates.

And when fuel costs rise, everything that relies on transport follows – from groceries to clothing to construction materials.

“The direct impact that we are seeing right now is the rise in petrol prices, and that affects, I would say, every household, particularly those on lower incomes who are forced to drive to work,” Kerr says.

“It is just another cost that they have to wear. And they have been in a cost-of-living crisis for the past three years.”

He warns that the conflict could push inflation higher while slowing growth, with Kiwi households already tightening spending, cutting discretionary purchases, and reducing travel and fuel use. Delaying big buys and trading down to cheaper brands are likely on the horizon.

“Yes, we are going to see a spike in inflation, but what I don’t agree with is the commentary that that automatically leads to a rate hike. I disagree.

“That is only going to put greater pressure on a household that is already under pressure. That would be the exact thing not to do … for me, the bigger risk is that households get hurt, the economy doesn’t recover, and the central bank may be needed to come in and provide support.”

He said economists entered the year “quite optimistic, because we had been banging the table for a long time, because the Reserve Bank had not cut interest rates to a level that was actually stimulatory and helpful for the recovery.

“They finally got there in November last year, took them far too long to get there, but they got there. We came into this year saying, ‘this is it, we are going to recover, the settings are about right, let’s go, c’mon let’s get some growth happening’, and mid-way through that sentence, we were cut off with missile strikes in Iran.

“It’s just another international shock that we have to deal with, and it’s just another headwind that all households and businesses have to face into.

“It’s hard for households to pay the food bill and power bill, which is up 35 percent on the year, petrol prices, which will be up a similar sort of amount, it is very, very difficult.

“We need to see policymakers stepping in to help, not hinder. So calls for rate hikes from the RBNZ [Reserve Bank] are tone deaf.”

On this episode, The Detail also speaks to Retail NZ chief executive Carolyn Young, who says retailers and consumers throughout the country are feeling the fallout of the war.

She says prices for goods and services will increase and “we will see that relatively soon”.

“We are seeing increases in insurance … increases in the fuel to get the ships to New Zealand,” she says. “Those additional costs are being passed on to the retailers and, at some point, those costs will be passed on to consumers.”

She says, right now, it’s “a really uncertain time for everyone”.

“Ultimately, uncertainty is not good for business. And I think that’s the thing we have to remember, and right now everyone is in a state of flux and uncertainty.

“And for any business owner, whether you are a retailer or other business, it’s going to have an impact on your sense of how you are going to move forward, and therefore it will have an impact on your profitability and ability to spend money in other areas.”

She fears some businesses might not survive the war.

“It will be difficult for people, and we will see some people who are perhaps a bit more pessimistic about what the future holds and may decide to close the store, and there will be others who will try to hang in there.”

She says recovery will depend on how long the conflict lasts.

Economists say a short conflict will see a sharp but temporary spike in prices, while a prolonged war will mean sustained inflation, weaker growth, and reduced spending.

And an escalation? Enter the risk of recession.

For now, the message from economists is simple: New Zealand may be far from the conflict, but it is not insulated from its consequences, because a war a world away involving oil doesn’t stay overseas for long.

Check out how to listen to and follow The Detail here.

You can also stay up-to-date by liking us on Facebook or following us on Twitter.

Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.

– Published by EveningReport.nz and AsiaPacificReport.nz, see: MIL OSI in partnership with Radio New Zealand

Source: Radio New Zealand

Higher fuel costs mean higher transport costs, and that means higher prices across the board – and that’s a hard pill to swallow for Kiwis three years into a cost-of-living crisis.

Kiwis are already feeling the expensive ripple effects of the war in Iran – and economists are warning that the real impact is only just beginning.

What started as a distant geopolitical conflict has quickly landed squarely on our country’s economy, driving up fuel costs, squeezing household budgets, and threatening to slow growth.

If it continues, New Zealand could be staring down the barrel of another recession.

“So this sort of shock, if it gets worse, will definitely increase the risk of a recession here,” Kiwibank chief economist Jarrod Kerr tells The Detail.

“And we have only just gotten out of recession, so to fall back in would be horrendous for households and businesses.”

At the centre of the crisis is oil.

Global prices have surged past US$100 a barrel as fighting disrupts supply routes through the Strait of Hormuz – a chokepoint for about 20 percent of the world’s oil.

And for New Zealand, which imports almost all of its fuel, the effect has been immediate.

Petrol prices are already climbing rapidly, with forecasts that they could push toward $4 a litre – or higher – if the conflict escalates.

And when fuel costs rise, everything that relies on transport follows – from groceries to clothing to construction materials.

“The direct impact that we are seeing right now is the rise in petrol prices, and that affects, I would say, every household, particularly those on lower incomes who are forced to drive to work,” Kerr says.

“It is just another cost that they have to wear. And they have been in a cost-of-living crisis for the past three years.”

He warns that the conflict could push inflation higher while slowing growth, with Kiwi households already tightening spending, cutting discretionary purchases, and reducing travel and fuel use. Delaying big buys and trading down to cheaper brands are likely on the horizon.

“Yes, we are going to see a spike in inflation, but what I don’t agree with is the commentary that that automatically leads to a rate hike. I disagree.

“That is only going to put greater pressure on a household that is already under pressure. That would be the exact thing not to do … for me, the bigger risk is that households get hurt, the economy doesn’t recover, and the central bank may be needed to come in and provide support.”

He said economists entered the year “quite optimistic, because we had been banging the table for a long time, because the Reserve Bank had not cut interest rates to a level that was actually stimulatory and helpful for the recovery.

“They finally got there in November last year, took them far too long to get there, but they got there. We came into this year saying, ‘this is it, we are going to recover, the settings are about right, let’s go, c’mon let’s get some growth happening’, and mid-way through that sentence, we were cut off with missile strikes in Iran.

“It’s just another international shock that we have to deal with, and it’s just another headwind that all households and businesses have to face into.

“It’s hard for households to pay the food bill and power bill, which is up 35 percent on the year, petrol prices, which will be up a similar sort of amount, it is very, very difficult.

“We need to see policymakers stepping in to help, not hinder. So calls for rate hikes from the RBNZ [Reserve Bank] are tone deaf.”

On this episode, The Detail also speaks to Retail NZ chief executive Carolyn Young, who says retailers and consumers throughout the country are feeling the fallout of the war.

She says prices for goods and services will increase and “we will see that relatively soon”.

“We are seeing increases in insurance … increases in the fuel to get the ships to New Zealand,” she says. “Those additional costs are being passed on to the retailers and, at some point, those costs will be passed on to consumers.”

She says, right now, it’s “a really uncertain time for everyone”.

“Ultimately, uncertainty is not good for business. And I think that’s the thing we have to remember, and right now everyone is in a state of flux and uncertainty.

“And for any business owner, whether you are a retailer or other business, it’s going to have an impact on your sense of how you are going to move forward, and therefore it will have an impact on your profitability and ability to spend money in other areas.”

She fears some businesses might not survive the war.

“It will be difficult for people, and we will see some people who are perhaps a bit more pessimistic about what the future holds and may decide to close the store, and there will be others who will try to hang in there.”

She says recovery will depend on how long the conflict lasts.

Economists say a short conflict will see a sharp but temporary spike in prices, while a prolonged war will mean sustained inflation, weaker growth, and reduced spending.

And an escalation? Enter the risk of recession.

For now, the message from economists is simple: New Zealand may be far from the conflict, but it is not insulated from its consequences, because a war a world away involving oil doesn’t stay overseas for long.

Check out how to listen to and follow The Detail here.

You can also stay up-to-date by liking us on Facebook or following us on Twitter.

Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.

– Published by EveningReport.nz and AsiaPacificReport.nz, see: MIL OSI in partnership with Radio New Zealand

Source: Privacy Commissioner

17 Mar 2026, 09:00

It’s great to be here today to:

• share some observations, from my perspective as Privacy Commissioner, about the place of cyber security in the minds of decision-makers, organisations, and the everyday person in the street, and
• talk about the linkages between privacy, stewardship of personal information, and cyber security.

But, before I get into that – a pop quiz …

Who said, less than a month ago, “It’s a reason why I have been advocating very strongly that we need to strengthen our cyber security laws here in NZ and also make sure that we are not laid back … I think in 2026 sometimes our New Zealand business environment has been way too laid back, and not taking the risks and the threats seriously enough.”

Yes, that was Prime Minister Chris Luxon.

And who said, again less than a month ago, “digital threats are growing and New Zealand must strengthen its defences … Every New Zealander who provides data to a government agency, or to a company contracted by one, is entitled to the same standard of care. When that data is breached, it is a violation of trust … We could improve incentives for entities holding New Zealanders’ data. We could increase penalties for hackers and scammers. We should also question whether it is even reasonable to demand New Zealanders provide sensitive information or digital identification for everyday activities.”

Yes, that was Deputy Prime Minister, David Seymour.

Now, like a lot of organisations, at my work we subscribe to a media alerts service, for media and other stories about privacy and related matters – including cyber. I arrived at work a week ago, the morning email from the service had just popped into my in-box … no privacy breach stories this time … but every story was a cyber one … every story!

‘NZ cyber strategy criticised as least bold in Five Eyes‘ … ‘Kordia releases latest cyber report‘ … ‘Expanding ransomware reach intensifies sector-wide cyber exposure‘ … ‘Rising sophisticated cyber-attacks aimed at advisors‘ … and ‘Increased DoS and brute force activity.’  

One morning’s worth of media stories on one day!

It seems that the public policy and media spotlights have swung their beams of light on to you.

You have to wonder, given this sort of political, public, and media interest, if we are on the cusp of cyber security leaving the wings, and coming to centre stage.

The question is, are we ready – and if we are, what are we going to do next?

Surveys and attitudes to cyber security

It’s always instructive to take ourselves out of our busy day to day context, and see how other organisations, and even other countries, are seeing cyber-security, and cyber threats.

Each year the Institute of Directors conducts a Directors’ Sentiment Survey and publishes the results with some commentary.  

In the 2025 report, the IoD noted, and I quote, that:

“Technology epitomises this shift from curiosity to commitment. Six in ten boards are now working with management on how AI and automation can lift productivity – the second-highest result since records began. Digital oversight has re-entered the mainstream, no longer the preserve of tech committees or early adopters. But the enthusiasm is tempered by uneven assurance: cyber vigilance has plateaued, with the proportion of boards discussing risk or receiving breach reporting barely moving in three years. In effect, boards are accelerating innovation without upgrading the brakes.”

While 57.2% of directors said their board discusses cyber risks, this figure has softened slightly from 2024, which was 62.2%. 

Likewise, 55.2% of boards report receiving comprehensive data breach or cyber-risk reporting, largely unchanged for three years after a sharp rise in 2023. 

Privacy and data protection show similar stagnation; 57.2% of directors said their board regularly reviews privacy risks, a figure largely unchanged from 2024.

Internet NZ’s recent survey results show New Zealanders continue to have concerns in the data space.

65% of those surveyed were extremely concerned or very concerned about the security of personal data.

Kordia have just released their 2026 NZ Business Cyber Security Report.

Some key take outs from that:

• 44% of large businesses were subjected to a cyber attack or incident in the past 12 months
• 17% of cyber incidents resulted in personal information being accessed or stolen
• 61% of businesses impacted by a cyber incident suffered a serious business disruption
• 30% of businesses surveyed said they lacked confidence that they could recover from a major cyber-attack.
• 25% said they had no cyber security awareness or training programme for their employees, and
• Around half had not practiced their incident response plans.

That’s not a brilliant picture.

Hence, the International Telecommunication Union’s global cybersecurity index last year ranked New Zealand in the third of five tiers, as an ‘establishing’ nation along side the likes of Kiribati and Myanmar.

The heightened cyber security risk environment has seen countries like Australia and Singapore among others, implement new cyber security legislation.

New regulatory frameworks are also increasingly being backed up with tools and manuals to support businesses to aim for and stay on the right side of the regulatory line.

And that is something the New Zealand Office of the Privacy Commissioner is also focused on.

Privacy and cyber security

It’s clear that there are many linkages between privacy and cyber security – and I want to begin by acknowledging that while my focus is on the stewardship of personal information, those working in cyber security are concerned about keeping all information – personal, financial, commercial, legal, marketing, the list goes on – safe and secure from harm. 

Some of you here today will of course be working in or managing the IT/IS/cyber teams in organisations, ensuring systems are hardened against cyber-attack, and that your work colleagues engage in cyber smart practices.

Some of you will be advisors, providing organisations with advice on the latest developments in cyber threats and defences. 

Some of you will be involved in research and development, seeking to get ahead of the cyber criminals and threat actors in the never-ending cyber war we all seem to be engaged in these days.

And some – like my Office – are focused on the risks to personal information.

My focus is making privacy a core focus for your agencies – in order to protect New Zealanders from harm, to enable organisations to achieve their own objectives, and to safeguard our free and democratic society.  

And when things go wrong – when there’s a serious privacy breach which might see personal information exfiltrated, or deliberately corrupted – we ask questions about what happened and why, and  – if it’s needed – we can hold agencies to account. 

Security of information and IT infrastructure is a critical component of a robust privacy programme. 

Both security and privacy staff must work together to identify external and internal risks, and to ensure that security is prioritised and resourced accordingly.

The Privacy Act 2020 is built around 13 privacy principles that govern how agencies (organisations and businesses) can collect, store, use and share personal information. 

The Privacy Act makes sure that:

• you know when your information is being collected
• your information is used and shared appropriately
• your information is kept safe and secure
• you can get access to your information.

As many of you will know, Principle 5 is concerned with storage and security of information.

It states that organisations must ensure there are safeguards in place, that are reasonable in the circumstances, to prevent loss, misuse or disclosure of personal information.

There are a number of different aspects to consider, including physical security, electronic security, operational security, security during transmission and during destruction.

What steps are appropriate will depend entirely on the circumstances, including:

• How sensitive is the personal information involved?
• What are you using the personal information for?
• What security measures are available, and how will using these measures impact on your agency’s functions?
• What might the consequences be for the individual if the information is not kept secure?

I thought you might be interested to get a sense of the state of play with privacy breaches in New Zealand.

So, this morning, I have the latest breaking stats and news for you.

• In the most recent quarter, 61% of serious privacy breaches were due to intentional or malicious activity, and 36% were due to human error … the days of most breaches being due to an email whoopsie seem to be long gone.
• For the reporting year to date, 21% were unauthorised access breaches (including ransomware), and 28% were unauthorised sharing or employee browsing.  

Employee browsing

Can I take the opportunity to touch on an increasingly serious privacy risk: that is, employee browsing.

The greatest threat to your workplace information security could be sitting in the office next to you at work.

Employee browsing or the unauthorised access and misuse of personal information is becoming one of the most common privacy breaches.

NZ is a small place, and there’s a good chance a familiar name will crop up in a database or on a file at work, and it can prove very tempting for some to have a look.

In some circumstances employees look up information and then pass it on for the explicit purpose of causing harm of some sort.

If your business or organisation holds sensitive personal information that your customers or clients would really, really not want to be revealed to someone else, like a violent former partner, or revealed to the public if someone happens to be a bit of a celebrity – then your organisation’s employees will, one day, come under pressure from others to access and hand over that information.

Attempts will be made to coerce, bribe, blackmail or threaten employees to access and misuse the personal information the organisation holds.  

So, my question for you is, has your organisation invested in the systems, regular database audit checks, employee induction processes, and so on, to deter and, if it happens, identify unauthorised access and misuse of personal information? 

Poupou Matatapu 

See our free online privacy toolkit.

Of course, my Office doesn’t always want to occupy the space of the privacy “ambulance at the bottom of the cliff”; increasingly, our focus is on working with people like you to “build the fence at the top”.

As I think I mentioned at last year’s conference, Poupou Matatapu is guidance on our website to help New Zealand agencies do privacy well – you can find it at privacy.org.nz.

It sets our expectations about what good privacy practice looks like and then helps organisations toward achieving that.

One of the components of this guidance focuses on security and internal access controls.  

The obligation to keep information safe and secure applies to information that is held by the organisation (for example, in on-premises servers) and information that is held on the organisation’s behalf by a service provider (for example, a cloud-based data storage provider). 

Remember, organisations are liable under the Privacy Act for the personal information stored and processed on their behalf.

The most effective strategy is having a well-thought-out security plan for all personal information you hold.

At a high level, this component of Poupou Matatapu describes key security controls across three areas – physical, technical, and organisational.

These controls are not exhaustive and are continually evolving. 

Organisations need to ensure that they update their knowledge on security risks, including seeking advice from external experts where necessary, and implement all reasonable security safeguards in a timely way.

I don’t need to tell this audience that there’s a world of cyber security guidance and standards out there. 

Providing security and IT advice is not a core function of my Office, so, in our guidance, we have provided links to advice and resources from other authoritative sources, such as NCSC, and others.

But, of course, like you, I have seen commentary around how to assess whether an organisation had reasonable security safeguards in place at the time of a security or privacy incident.

Reasonable security safeguards are those that are proportionate to an organisation’s role, scale, and risk exposure.

They reflect recognised national expectations at the time the safeguards were implemented and operating prior to the breach. 

This approach does not require best-in-class or exhaustive controls, instead focusing on intent, decision-making, and proportionality.

It anchors reasonableness in nationally recognised frameworks, uses well-understood national standards like the NCSC Minimum Cyber Security Standards as a defensible baseline, and applies sectoral-specific standards – such as those applying to the health sector – as contextual overlays.

This approach provides a clear basis for determining whether reasonable security safeguards were in place at a given point in time.

The other day I was reminded of a comment from Misti Landtroop, the NZ country manager for cybersecurity company Palo Alto Networks.

She said that many cyber breaches were preventable, with things like security culture, level of knowledge, and willingness to invest, all factors that left organisations vulnerable to cyber-attack.
Organisations also make mistakes because they either don’t understand the value of privacy, or don’t care. 

Sometimes privacy is as easy as just ensuring your IT systems are up to scratch and making sure you’ve thought about access, have got the permissions set correctly, and have tested them.

For example, a while back the UK Information Commissioner issued a 4.4million pound fine to a company which, in the Commissioner’s view, failed to follow up on the original alert about some suspicious activity, used outdated software systems and protocols, and had a lack of adequate staff training and insufficient risk assessments – all of which ultimately left them vulnerable to a cyber-attack.

The Commissioner commented at the time: “The biggest cyber risk businesses face is not from hackers outside of their company, but from complacency within their company.  If your business doesn’t regularly monitor for suspicious activity in its systems, and fails to act on warnings, or doesn’t update software, and fails to provide training to staff, you can expect a similar fine from my Office.”

From my perspective, and reflecting on all this commentary, since taking up my role I have made it clear that agencies need to keep front of mind that, in the case of a cyber security incident resulting in a data privacy breach, one of the first questions I will ask is “has the agency undertaken all reasonable security safeguards” to protect the personal information under their care.  

Health sector

Turning to the cyber elephant in the room, recent events in NZ would suggest that one sector which is well and truly facing some cyber security challenges, is the health sector.

Just a reminder: on 22 February, MediMap — a private portal used by aged-care homes, hospices, disability services and community health providers to coordinate prescriptions and record medication histories — was taken offline after it was discovered that some patient records had been tampered with by an unauthorized actor. 

MediMap’s early investigations identified changes to fields including names, birthdates, assigned prescriber, and location of care and resident status, with some living patients incorrectly marked as “deceased.”

This event was unsettling not only because of the direct impact on individuals and clinical operations, but also because it followed another high-profile breach —the Manage My Health breach in late 2025, which involved the exfiltration of hundreds of thousands of medical documents. 

One of New Zealand’s leading privacy commentators, Daimhin Warner, commented at the time:

“Taken together, these events suggest a broader pattern of cyber risk in health tech that goes beyond isolated vendor errors.”

“Several key themes are starting to emerge. First is the need for clarity of expectations. What baseline technical and organizational safeguards should be required for systems handling highly sensitive health information? Mandatory controls — for example, multifactor authentication, encryption at rest and in transit, regular independent security audits and incident response obligations — could help raise the floor of protection.”

“Second is making sure the health sector understands who is really accountable for ensuring these baseline safeguards are in place. It is alarmingly clear from these recent breaches that many organizations in the health sector do not fully understand their accountabilities and responsibilities.”

Daimhin Warner notes that the recent publication of the National Cyber Security Strategy has occurred at a time when some of the government agencies tasked with cyber security are making it clear that New Zealand has a long way to go before we can say our standards and approach meet international good practice.

And by the same token, then, we have a long way to go before we can assure New Zealanders, whoever they are … customers, clients, citizens … that their privacy is being protected and respected.

GCSB Director-General Andrew Clark said recently that “unfortunately, there are … pockets, including in our critical infrastructure, where cybersecurity is barely meeting that foundational level that we would expect.”

AI

And of course, AI is only making the challenge facing the cyber security industry even harder.

Reports show increasingly that AI agents are supercharging cyber-attacks by industrialising the scale of them.  

In the Internet NZ survey I referred to earlier, 59% of those surveyed were very or extremely concerned about the use of AI to violate privacy.

And the Kordia survey found that a quarter of medium to large businesses now rank staff misuse of AI among their biggest cyber challenges, and that attacks involving AI-related vulnerabilities have more than doubled year on year.

Director-General Clark also noted that while smaller organisations might not meet the critical infrastructure description, many still hold a lot of sensitive personal information that needs protection.

So, no matter the sector, and no matter the size, there are questions we all need to be asking, and expectations that need to be met, in today’s increasingly super-charged threat environment: 

From where I sit, those expectations include:

• Security controls are specific to the type and sensitivity of information held across the organisation, rather than a ‘one size fits all’ approach.
  Regular auditing of systems is undertaken to ensure appropriate access.
• An organisation follows industry guidelines and security standards relevant to its business context.
• There is a remediation plan for managing and/or replacing legacy systems (where necessary).
• Identified risks are proactively managed – for example, by incorporating them into the organisation’s risk and assurance reporting processes to ensure visibility, and
  Organisational controls – policies, procedures, and decisions – are regularly reviewed and fit for purpose.

Conclusion

People of cyber … at this time in New Zealand’s history you face your greatest challenge, and your greatest opportunity.

It’s your time to shine!

MIL OSI

MIL OSI

Source: Radio New Zealand

Tasman District ratepayers are facing a rates increase of almost 10 percent, as the council grapples with the costs of last years floods and three waters infrastructure, on top of its core business.

Last week, the Tasman District Council elected members were split on moving forward with its draft annual plan which had an average rates increase of 9.9 percent, with sent staff back to the drawing board to consider how to further cut costs.

The split vote of 7-7 forced the council to seek legal advice after the plan failed to progress.

At an emergency meeting today, elected members voted 10-4 to put the draft annual plan out for consultation. The average rates increase for the 2026-27 remained at 9.9 percent, with an end of year debt of $320 million, $8m less than what was proposed at the last meeting.

The increase includes 2.3 percent for the costs of last year’s weather events, 5.3 percent for three waters cost increases and 2.3 percent for the rest of council business, which is below the government’s proposed 4 percent rates cap.

Council chief executive Leonie Rae told elected members that it had taken the direction to lower rates and had come back with options that could be exercised within the annual plan boundaries, with clarity on what the impact on the community would be.

She said the organisation was running lean, the salary budget had been reduced by $1.4m and it was running with around 40 staff under its FTE, and there were “continuing efforts to find efficiencies, savings and extra revenue where possible”.

Rae said in comparison to other councils, Tasman’s rates per capita were $1673, while the average was $1898. The district’s rates per rating unit were $3668, compared to an average of $3876.

“We are doing work and continuing to try and improve our financial position because we’re ratepayers too and no one wants to come to you with big figures, least of all of us.

“I do want to stress to you that further cuts into the operations will have to make significant cuts to levels of service because everyone is very, very busy.”

At last week’s meeting, elected members debated how the proposed storm recovery rate should be set, how much of the roading renewals should be funded by debt, and whether several community facility projects should be paused or not.

At today’s meeting, there was further discussion about the council’s debt in the short term, and whether to increase depreciation to get some debt relief.

One of the more contentious recommendations from last week was that a targeted weather event recovery rate of $125 be introduced for five years to fund $14.6m of the council’s recovery costs from the two winter floods last year.

Councillor Timo Neubauer proposed an amendment that the rate be set on capital value, instead of being a fixed amount per rating unit, which was lost 8-6, with staff agreeing it could be included as an option in the consultation document though the fixed charge would remain the preferred option.

Neubauer said the council had spent the last few months looking for savings, which hadn’t been easy and he hoped the process could be refined in the future, so elected members had more detail about major capital projects, earlier in the process.

He said he and others had asked for more detail around significant increases in the Three Waters infrastructure projects, and aggregated figures made it hard to understand what was driving the costs and where prioritisation could have occurred.

Mayor Tim King said the region was facing continued pressure in many areas, as was the rest of the country.

“That is the situation we are in all the time, pretty much the whole time I have been in this seat, things have come from left field, Covid, floods, it has been never ending the challenges.”

He said “uncertainty was the name of the game” and the council needed to be adaptable and flexible as it faced those challenges.

King said the council was not a business but instead had to provide a mix of community services, act as a regulator and be an infrastructure provider while also promoting growth.

“We have all of these roles and all of these hats and they don’t fit neatly into a tidy financial package.”

Councillor Trindi Walker asked whether there was any room for movement, if the feedback from the community after consultation was that they could not afford a 9.9 percent rates rise.

“Do we have room to suddenly stop, pause, look and acknowledge what our community is saying? Or are we so far in now that we have to wait for the long-term plan?”

Deputy Mayor Brent Maru supported the motion and said the diversity around the council table was a good thing.

“The debate and the different views and the different suggestions isn’t unhealthy for the system.”

“As we work through this, we will compromise, we will check the decisions we make on behalf of the communities we represent and come up with a collective decision.”

Councillors Mark Greening, Mark Hume, Dean McNamara and Paul Morgan voted against moving the updated draft annual plan to consultation.

McNamara said he wanted to see more action taken to reduce costs.

“This plan’s still going out with building nice-to-haves when we’re borrowing money to pay for our business as usual, all which increase both our debt and our ongoing costs.”

Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.

– Published by EveningReport.nz and AsiaPacificReport.nz, see: MIL OSI in partnership with Radio New Zealand