We use and disclose personal information to perform our functions and to keep New Zealand and New Zealanders safe.
This includes personal information collected by our National Cyber Security Centre (NCSC).
-
Read more about NCSC’s privacy statement.
-
Read more about our work.
We aim to be as open and transparent as possible. However, in order to protect New Zealand’s interests, we are not able to provide some details about our processes and the information we hold.
While the GCSB is subject to the Privacy Act 2020, we are exempt from a limited number of principles under the Act. The principles we are exempt from mean we do not have to:
- collect personal information directly from the person concerned
- take steps to ensure that the person is aware of the collection
- collect personal information by means which are fair or do not intrude to an unreasonable extent into a person’s affairs.
We can also use or receive personal information collected for one purpose, for another purpose where there are reasonable grounds to believe it is necessary to do so to enable us to perform any of our functions.
The Privacy Act gives you the right to request access to personal information we hold about you and to request a correction or alteration.
Read more about requesting personal information.
We collect and receive personal information from a wide range of people, organisations, agencies and activities in order to perform our functions and to keep New Zealand and New Zealanders safe. These include, but are not limited to:
- individuals
- other agencies or entities
- online activity
- technical devices.
Read more about our intelligence collection.
Read more about our National Security Cyber Centre (NCSC).
Read more about how we work with other government agencies.
We can collect information in a number of ways:
- Information can be given to us without us asking for it. For example, someone may contact us via our website.
- It is provided to us in response to a request from us.
- We have collected it under an agreement or arrangement.
- We have collected it under the authority of an intelligence warrant or business record direction.
The nature of what we do means people will often not be aware that we hold information about them.
We have stringent requirements on the handling of all information and we store it in a secure manner to prevent unauthorised access.
We protect personal information by ensuring we follow the Government’s Protective Security Requirements and following best practice, including:
- making sure personal information is protected from outside sources
- applying access controls and appropriate safeguards within our agency
- maintaining regular backups of our data
- using the most appropriate security systems available.
Read more about the Protective Security Requirements(external link).
We only keep personal information for as long as it is necessary for the performance of our functions or as required by law, for example under the Public Records Act 2005.
Read more about the Public Records Act on the Archives New Zealand website(external link).
We use a range of tools to manage our handling of personal information, including internal policies on data handling and storage and Privacy Impact Assessments.
More information about Privacy Impact Assessments is available on the Office of the Privacy Commissioner website(external link).
We share information and cooperate with both domestic and international partners, enabling us to identify or respond to a range of threats and to draw on support, technology and intelligence that would otherwise not be available to us.
This may include sharing information to mitigate a threat to New Zealand, to inform government decision making, or as part of advice related to protective security services and national security risks.
We share information domestically or internationally in accordance with relevant New Zealand law and human rights obligations recognised by New Zealand law.
We take all reasonable steps to ensure the accuracy of the personal information we use or disclose.
Read more about our legislation.
If you provide information about an incident via our website we may contact you to discuss it.
Read more about reporting an online issue or security incident to NCSC(external link).
The information you provide to us is held securely in accordance with our legal obligations.
We may choose to share the information you have provided with another agency, such as New Zealand Police.
We may collect information about your online interaction with our websites.
Generally, we use the information that we collect from your use of our website for statistical and website improvement purposes. We also use the information we collect where a disclosure is required or authorised by law.
Read more about your privacy when visiting our websites.
Please contact us if you have feedback or complaints that relate to privacy. You can also contact us to request personal information you think we might hold about you.
You can contact us via email, information@gcsb.govt.nz.
Read more about requesting personal information.
You can contact the Office of the Privacy Commissioner.
Visit the Office of the Privacy Commissioner website(external link).
You can also call the Office of the Privacy Commissioner, 0800 803 909, Monday to Friday, 10am – 3pm.
You are entitled to complain to the Inspector-General of Intelligence and Security if you feel that you have been adversely affected by an act, omission, practice, policy or procedure of GCSB.
Visit the Inspector-General of Intelligence and Security website(external link).