Aon warns New Zealand firms on Asia-Pacific cyber rules

Aon has warned that New Zealand organisations face an increasingly complex cyber and data privacy regulatory environment across Asia Pacific, with a single cyber incident potentially triggering reporting obligations in several jurisdictions.

The warning is based on a regional review of cyber security and data privacy rules across 14 Asia Pacific locations. It found that regulators are tightening breach notification requirements, increasing penalties and stepping up enforcement.

For New Zealand businesses, the issue is especially relevant when operations span several markets, customer data is stored offshore, or services are provided to international clients. In those circumstances, a single cyber event may fall under more than one legal regime, adding pressure to response teams already dealing with operational disruption and external scrutiny.

Under New Zealand's Privacy Act 2020, organisations must notify the Office of the Privacy Commissioner and affected individuals when a privacy breach is likely to cause serious harm. Failing to notify the regulator without reasonable excuse can lead to a maximum penalty of NZ$10,000.

The report also highlights uncertainty around the insurability of fines under the Privacy Act. It says no New Zealand legislation specifically prohibits insurance cover for those fines, but whether a penalty is insurable may depend on the conduct involved, the purpose of the fine and broader public policy considerations.

Different regimes

Across the region, mandatory data breach reporting applies in 13 of the 14 locations reviewed. Reporting deadlines vary widely, from one hour to 30 days, while the treatment of cyber-related fines under insurance policies differs between markets.

That variation creates a practical challenge for businesses operating across borders. Legal teams, risk managers and incident response specialists may need to determine quickly which regulator must be notified, what threshold applies, how fast action is required and whether potential penalties or response costs are covered by insurance.

The regional review, produced with legal input from Wotton Kearney, examines regulatory developments up to June 2026. It covers breach notification requirements, enforcement mechanisms, penalties, the insurability of cyber fines and the legality of ransom payments.

Duncan Morrison, Head of Cyber Solutions, New Zealand, Aon, said the cross-border nature of many businesses means incident planning must account for differing legal expectations before a breach occurs.

"Many New Zealand organisations operate across multiple markets, hold data offshore or serve international customers," Morrison said. "A single cyber incident may trigger reporting obligations across several jurisdictions. Understanding those requirements before an incident occurs can help organisations respond with confidence when an event happens."

Businesses also face costs beyond any direct regulatory penalty. Cyber incidents can interrupt trading, trigger legal work, require forensic and communications support, and expose companies to regulatory action in more than one country.

"A regulatory fine is only one component of the potential cost of a cyber incident. Organisations may also experience business interruption, legal expenses, incident response costs, regulatory action and reputational damage," Morrison said. "A cyber incident can quickly become more complex when operations, data or customers span multiple locations. Organisations need to understand how regulatory requirements differ across markets and how those differences may affect decision-making during an incident."

The findings come as boards and executive teams face growing expectations to treat cyber response as a governance issue rather than only a technical one. For companies operating across Asia Pacific, that means incident readiness plans may need to align legal, insurance and communications processes with local reporting rules in each market.

Response planning

The report argues that preparedness should extend beyond assigning cyber security roles. It suggests organisations should test incident response procedures and review insurance arrangements to identify gaps before an event forces urgent decisions.

This reflects a broader shift in cyber risk management, in which the speed and sequence of reporting obligations can be as important as the technical response. A delay in identifying who needs to be informed, or by when, can create a second layer of risk after the initial incident.

"Organisations often focus on cyber security roles, but response planning is equally important. Testing incident response processes and insurance arrangements can help organisations identify gaps and strengthen preparedness before an incident occurs," Morrison said.