IPP 3A: telling people when you get their details from someone else
Since 1 May 2026, a new Privacy Act rule says that when your charity collects information about a person from someone other than that person, you must take reasonable steps to make them aware of it. Referrals, whānau, partner agencies and event partners all count. Here is what you must tell people, when you don't have to, and what to record in your CRM.
A privacy breach at your charity: who to tell, and how fast
If your charity loses control of personal information and it's likely to cause serious harm, the Privacy Act 2020 requires you to tell the Privacy Commissioner as soon as practicable, and the people affected. The Commissioner expects that within 72 hours of you knowing. Here is what counts, the order I'd work in, and what to have ready before anything goes wrong.
Zoho CRM and your charity's information: a briefing for boards
A board asking about a donor database usually asks one thing: is our supporters' information safe, and does the law allow it? It can be safe, if it's set up properly. Zoho CRM holds your data in Australian data centres, and the Privacy Act 2020 keeps your charity accountable for it wherever it sits. Here is where it is held, how it is protected and how each legal duty is met.