112Interpretation

1. In this subpart,—

   affected individual, in relation to personal information that is the subject of a privacy breach,—

   1. means the individual to whom the information relates; and
   2. includes an individual inside or outside New Zealand; and
   3. despite the definition of individual in section 7(1), includes a deceased person—
      1. if a sector-specific code of practice issued under section 32 specifies that the code applies to information about deceased persons; and
      2. to the extent that the code of practice applies 1 or more IPPs to that information

   notifiable privacy breach—

   1. means a privacy breach that it is reasonable to believe has caused serious harm to an affected individual or individuals or is likely to do so (see section 113 for factors that must be considered by an agency when assessing whether a privacy breach is likely to cause serious harm); but
   2. does not include a privacy breach if the personal information that is the subject of the breach is held by an agency who is an individual and the information is held solely for the purposes of, or in connection with, the individual’s personal or domestic affairs

   privacy breach, in relation to personal information held by an agency,—

2. means—
   1. unauthorised or accidental access to, or disclosure, alteration, loss, or destruction of, the personal information; or
   2. an action that prevents the agency from accessing the information on either a temporary or permanent basis; and
3. includes any of the things listed in paragraph (a)(i) or an action under paragraph (a)(ii), whether or not it—
   1. was caused by a person inside or outside the agency; or
   2. is attributable in whole or in part to any action by the agency; or
   3. is ongoing.

4. For the purposes of this subpart, the meanings of access, disclosure, and loss are not limited by the use of those words or the meanings ascribed to them elsewhere in this Act.