Michael Morgan
Director
Connection lost Trying to reconnect...
Server disconnected Trying to reconnect...
Business & Commercial
Protect what makes your business valuable.
Trade secrets, customer data, strategic plans. The right agreements and practices keep your confidential information secure.
The Assets
Information that drives your business.
Confidential information comes in many forms. All of it needs appropriate protection. What gives your business its competitive edge could walk out the door.
Trade Secrets
Your unique methods, formulas, and processes that give you competitive advantages. Once disclosed, they lose their protection forever.
Customer & Client Data
Personal information, purchase history, preferences - all subject to strict privacy obligations under the Privacy Act 2020.
- Contact details and identifiers
- Transaction and payment data
- Behavioural and preference data
Business Strategy
Expansion plans, pricing strategies, market analysis - information competitors would value. Premature disclosure can kill deals before they happen.
Deal Information
M&A discussions, partnership proposals, investor conversations. Premature disclosure can kill deals and damage valuations.
NDAs & Confidentiality Agreements
The primary tool for protecting sensitive information.
Before you share financials, reveal your business model, or open your books, the right non-disclosure agreement (NDA) establishes clear boundaries.
One-Way NDAs
Protect information flowing in one direction. Use these when you are the only party sharing sensitive information - for example, with contractors or during investor pitches.
Best for Pitches & ContractorsMutual NDAs
Protect both parties when both sides share confidential information - for example, in business partnership discussions or joint venture negotiations.
Best for Partnerships & JVsDefinition
What information is confidential (be specific)
Permitted Use
What the recipient can use it for
Permitted Users
Who can see and use the information
Exclusions
Information already public or independently developed
Staged Release
Release information in stages relating to other party's conditions (eg finance, state of physical assets, employee review, IP). Release the most sensitive last.
Term
How long obligations last (usually 2-5 years)
Return
What happens when the relationship ends
When NDAs are not enough
An NDA only works if you can enforce it. Consider whether the other party has assets in New Zealand, whether you would be willing to take legal action, and whether the damage would already be done before any court case. For truly sensitive information, consider whether you should share it at all.
Privacy Act 2020
What happens when things go wrong →
Compliance is not optional.
Collection
Principles 1-4
- • Purpose of collection
- • Source of information
- • Collection from the individual
- • Manner of collection
Storage & Security
Principle 5
Agencies must protect personal information using security safeguards that are reasonable in the circumstances.
Individual Access
Principles 6-7
Individuals can request access to their information and ask for corrections. You must respond within 20 working days.
Accuracy & Retention
Principles 8-9
- • Check accuracy before use
- • Do not keep longer than needed
Use & Disclosure
Principles 10-11
- • Use only for intended purpose
- • Disclose only when permitted
Cross-Border
Principle 12
Special rules apply when disclosing personal information to overseas recipients - particularly relevant for cloud services.
When Things Go Wrong
72-hour notification deadline.
Data breaches happen. How you respond matters. A privacy breach posing serious harm risk must be notified within 72 hours - or face fines up to $10,000.
01
Contain
Stop the breach from continuing. Change passwords, revoke access, secure systems. This is immediate - within hours, not days.
Immediate
02
Assess
What information was exposed? How many people affected? What could someone do with this information? This determines notification obligations.
Within 24 hours
03
Notify
If there is risk of serious harm, notify the Privacy Commissioner and affected individuals within 72 hours. We can help you determine what to say.
Within 72 hours
04
Manage
Communicate clearly with affected people. Offer practical help (like credit monitoring if financial data was exposed). Document everything.
Ongoing
05
Prevent
Conduct a post-incident review. What went wrong? What would have prevented this? Update your systems and practices accordingly.
Post-Incident
How We Help
NDAs & Confidentiality Agreements
Drafting
Tailored to your specific situation and enforceable in practice. One-way, mutual, or embedded in commercial contracts.
Privacy Compliance Reviews
Assessment
Assessing your current practices against the 13 Information Privacy Principles. Identifying gaps before they become problems.
Data Breach Response
Urgent
Immediate advice when a breach occurs, including notification requirements and stakeholder communications.
Trade Secret Protection
Strategy
Practical steps to maintain the secrecy that makes information valuable. Policies, contracts, and internal controls.
Employee Obligations
HR/Legal
Clear policies and agreements for your team. Exit procedures that protect your information when employees leave.
Your Team
Meet the team
behind your privacy
Common Questions
Any existing documents relevant to your situation: company records, contracts, agreements you are considering, or details of issues you are facing. But if you are just at the thinking stage, that is fine too.
