Know what you collect and why
Keep a simple data inventory: what personal data each feature collects, why, where it is stored, and who can access it. Collect only what the feature genuinely needs.
Registration and responsibilities
Organisations processing personal data may need to register with the Office of the Data Protection Commissioner as a data controller or processor. Confirm your obligations with qualified counsel early, before launch rather than after.
Build the rights into the product
Data subjects can ask to access, correct, or delete their data. If that request means an engineer running ad-hoc queries, build the tooling now.
- Export a user's data on request
- Correct and delete records cleanly, including backups policy
- Record consent and its withdrawal
Secure by default
Encrypt personal data in transit and at rest, apply least-privilege access, and log who accessed what. These controls are good engineering whether or not a regulator ever asks.
Plan for breaches
The Act sets tight timelines for notifying the Commissioner after a breach. Have an incident plan, named owners, and a way to quickly establish what data was affected.