Questions are ordered through the research-integrity workflow: jurisdiction locking, source selection, verification status, claim-level citation, Australian-contamination screening, legal-status checking, honest use of real-world voices and final quality controls.
What is the clean-room methodology, and why does it matter for New Zealand security guidance?
The clean-room methodology is an editorial and research-control process for producing guidance inside a defined New Zealand evidence boundary. It begins by locking the jurisdiction, approved authorities, review date, terminology and output structure before research starts. Each material answer is then rebuilt from current New Zealand legislation, regulators and government cyber guidance rather than adapted from an Australian, United States or generic global template. Directly supported facts are separated from reasoned inferences, every material claim receives a source and date, and quotations are checked at their original location. A final contamination pass searches for foreign regulators, statutes, framework names, legal tests, currencies, emergency numbers and reporting deadlines. This is not a statutory methodology or a technical data clean room; it is the site's documented research-integrity method. It matters because superficially similar New Zealand and Australian cyber topics can involve different statutes, regulators, legal tests, terminology and consequences.
- jurisdiction lock — Define New Zealand, the review date, approved authorities, excluded foreign instruments and applicable sector scope before drafting.
- claim-level grounding — Attach each material factual proposition to a current primary source rather than citing a general reading list.
- status separation — Distinguish direct source-backed fact, reasoned inference, proposal, guidance, legal duty and practitioner sentiment.
- quality-control pass — Check source resolution, quotation accuracy, dates, legal status, scope, terminology and foreign-jurisdiction leakage.
Our clean-room methodology rebuilds each answer from current New Zealand primary sources inside a locked jurisdiction boundary. We distinguish verified facts from reasoned inferences, cite every material claim with a source and date, check the legal status and scope of each instrument, verify quotations at their original location and screen the final content for foreign-law or foreign-framework contamination.
What is jurisdiction contamination, and why does Australian content leak into New Zealand guidance?
Jurisdiction contamination occurs when a source, rule, regulator, legal test or framework from one country is presented as though it applies in another. It often enters through copied templates, search results that rank Australian pages highly, international software defaults, overseas legal commentary or source material that uses similar English-language terminology. In this research programme, contamination includes describing the Australian Privacy Act 1988 or APPs as New Zealand privacy law; sending New Zealand readers to the OAIC; importing Australia's eligible-data-breach terminology or general assessment process; calling the Essential Eight, SMB1001 or ASD ISM New Zealand frameworks; applying the Fair Work Act instead of the Employment Relations Act 2000; or referring to the Corporations Act instead of the Companies Act 1993. The screening question is not whether a foreign source is respected. It is whether the cited instrument, authority, duty or framework applies to the New Zealand entity and issue being discussed.
- legal contamination — A foreign statute, legal test, penalty, regulator or reporting deadline is presented as New Zealand law.
- framework contamination — A foreign government or private control framework is described as an official New Zealand baseline.
- terminology contamination — Foreign defined terms such as APPs or eligible data breach replace the terms used by New Zealand law.
- scope contamination — A genuine New Zealand sector requirement is incorrectly generalised to every private business.
Jurisdiction contamination occurs when a foreign law, regulator, legal test, framework, deadline or defined term is presented as applicable New Zealand authority. Every source must be checked for country, issuer, legal status, entity scope, sector scope and review date before it is used.
Which primary New Zealand sources should ground each answer?
Use a source hierarchy. Start with current New Zealand legislation for legal duties, definitions, offences, powers and commencement. Use the Office of the Privacy Commissioner for application of the Privacy Act, the Information Privacy Principles, privacy officers, breach notification and operational privacy guidance. Use the NCSC for cyber frameworks, controls, threat information and incident reporting, and Own Your Online for practical small-business and individual guidance. Use NZISM when detailed government information-security controls are relevant, while preserving its government-focused scope. Add the relevant New Zealand sector regulator, court, tribunal or authority when a topic concerns finance, telecommunications, employment, health or another regulated field. Secondary summaries may help find an issue but should not replace an available primary source. Forum material may identify real questions and vocabulary but cannot establish what the law requires.
- New Zealand Legislation — Primary source for current Acts, Bills, secondary legislation, commencement, versions and legal status.
- Office of the Privacy Commissioner — Primary authority for Privacy Act guidance, IPPs, privacy officers and breach-notification practice.
- NCSC and Own Your Online — Primary operational cyber sources for frameworks, controls, incident reporting and practical SME guidance.
- sector authority — Use the regulator, court or statutory body responsible for the specific entity, sector or employment issue.
Legal claims begin with current New Zealand legislation. Privacy claims are checked against the Privacy Act and OPC. Cyber-control and incident claims are checked against NCSC and Own Your Online. NZISM is used with its government-focused scope intact. Sector-specific claims require the responsible New Zealand regulator or authority. Secondary sources and forums may support discovery or context but do not replace an available primary source.
What is the difference between a VERIFIED claim and an INFERRED claim?
A VERIFIED claim is a factual proposition directly supported by the cited source at the stated date. The source should establish the material part of the statement without requiring a substantial interpretive leap. An INFERRED claim is a reasoned conclusion, recommended implementation or negative finding derived from one or more relevant sources but not stated directly by them. Examples include concluding that a documented exception register is proportionate, that a particular policy title is not universally mandated, or that an Australian instrument should not be presented as New Zealand law. Inference is not a synonym for unreliable; it identifies where editorial reasoning begins. A statement should also be marked as proposed, historical, superseded, sector-specific or guidance where that status is material. When a direct source cannot be found, the method does not upgrade a plausible assertion to VERIFIED merely because it sounds correct.
- VERIFIED — The cited primary source directly supports the material factual proposition and its stated scope.
- INFERRED — The conclusion is reasoned from relevant evidence but is not stated directly by the cited source.
- status qualifier — Identify proposals, guidance, historical rules, sector limits and implementation recommendations separately.
- unresolved claim — Remove, narrow or mark uncertain rather than manufacturing verification.
VERIFIED means the cited source directly supports the material claim. INFERRED means the conclusion is reasoned from relevant sources but is not stated directly by them. Inference is disclosed rather than hidden. A claim is narrowed, qualified or removed when its legal status, scope or supporting source cannot be established.
How does the methodology make every claim checkable?
Each material claim is written as a discrete proposition and supplied with a source name, plain source URL and date. The link should resolve to the page or legislation that supports the claim rather than merely to an organisation's homepage. The claim must preserve important distinctions between statutory wording, regulator guidance and editorial recommendation. Privacy-breach timing is a useful example: section 114 of the Privacy Act requires notification to the Commissioner as soon as practicable after awareness of a notifiable privacy breach, while OPC operational guidance says notification should ideally occur within 72 hours even if investigation continues. Writing only 'the legal deadline is 72 hours' removes that distinction. Checkability also requires recording the review date, using the current version of legislation, retaining source titles and avoiding quotations or statistics that cannot be found at the cited location.
- atomic claim — Write one checkable factual proposition rather than combining unrelated legal, technical and editorial assertions.
- source metadata — Record source name, direct URL and publication, commencement, version or review date.
- precision of authority — Distinguish statutory language, regulator guidance, framework advice and site-created recommendations.
- resolution test — Open the final URL and confirm that the cited source still contains the proposition at publication time.
Every material claim must be independently checkable from its cited source. The claim records a source name, direct URL and date and preserves the difference between legislation, regulatory guidance and editorial recommendation. The final verification pass opens each source, confirms its scope and status and checks that quotations, figures and legal wording remain present.
How does the method screen out Australian instruments and terminology?
The contamination screen checks every law, regulator, framework, defined term, penalty, currency, emergency number and reporting clock. New Zealand privacy content should use the Privacy Act 2020, Information Privacy Principles and Office of the Privacy Commissioner. Its breach analysis should use the notifiable-privacy-breach and serious-harm provisions, the requirement to notify as soon as practicable and the separate OPC guidance about an ideal 72-hour window. Cyber guidance should use NCSC, Own Your Online and, where its scope is relevant, NZISM. Employment content should begin with the Employment Relations Act 2000 and Employment New Zealand, while New Zealand company-law references should use the Companies Act 1993. The Australian APPs, OAIC, eligible-data-breach framework, Essential Eight, SMB1001, ASD ISM, Fair Work Act, Corporations Act and SOCI Act may be named only to explain a comparison or exclusion. Their appearance triggers a scope check; they are never silently converted into New Zealand authority.
- privacy contrast — Use New Zealand IPPs, OPC and serious-harm notification provisions, not APP or OAIC terminology.
- cyber-framework contrast — Use NCSC, Own Your Online and appropriately scoped NZISM, not Australian frameworks presented as New Zealand baselines.
- employment and company-law contrast — Use the Employment Relations Act 2000 and Companies Act 1993 for New Zealand issues.
- foreign-source exception — Retain a foreign source only when the comparison, overseas obligation or contractual relevance is expressly stated.
The final jurisdiction screen searches for foreign statutes, regulators, frameworks, defined terms, penalties, currencies, phone numbers and reporting deadlines. Australian instruments may appear only as expressly labelled comparisons or separately applicable overseas obligations. They must never be described as New Zealand law, regulation or official New Zealand cyber guidance.
How does the method handle proposals, Bills and requirements that are not yet law?
The method checks both document type and legal status. New Zealand Legislation explains that a Bill is proposed law and becomes an Act only if enacted. A page may also identify legislation as in force, repealed, revoked or not yet in force. Consultation papers, Cabinet announcements, regulator proposals, draft standards and introduced Bills are therefore labelled PROPOSED, DRAFT or NOT YET IN FORCE and are not written as current duties. The content records the expected commencement date where an enacted provision has not yet started and schedules a review rather than assuming commencement will occur unchanged. IPP 3A illustrates the importance of time-specific status: it was previously a future Privacy Amendment Act requirement but came into force on 1 May 2026 and must now be described as current law. Historical claims retain the date and status that applied at the time.
- Bill or proposal — Label as proposed, identify the sponsoring authority and do not present it as an enacted duty.
- enacted but not commenced — State the commencement date and separate current duties from future obligations.
- in-force law — Use the current official version and confirm amendments and commencement.
- historical or superseded rule — Use only for time-specific analysis and clearly identify that it no longer states the current position.
A Bill, consultation paper, proposal or draft standard is not described as current law. We check whether an instrument is enacted, in force, not yet in force, repealed or superseded and record the relevant date. Future requirements are labelled PROPOSED or NOT YET IN FORCE until their legal status changes, at which point the affected guidance is re-verified.
How are forums and real-world voices used honestly?
Forum material is used as voice-of-customer evidence, not legal authority. It can reveal the questions people actually ask, the language they use, recurring misunderstandings and the practical friction created by security controls. A forum quotation is included only when the original thread can be opened, the exact words can be confirmed, the date and context are recorded and the speaker is not falsely represented as a regulator, lawyer or technical authority. Ellipses must not change meaning, and identifying details should not be added. The answer grounded in law or official guidance remains separate from the quotation. If a suitable New Zealand quotation cannot be verified, the quotes array remains empty. Anonymous comments are never used to establish a statutory duty, regulator position, technical standard, prevalence figure or legal conclusion.
- discovery signal — Use real-world discussion to identify questions, vocabulary, objections and implementation pain.
- quotation verification — Open the original thread and confirm wording, URL, date and surrounding context.
- authority boundary — Label the quotation as sentiment or practitioner experience rather than law or regulatory guidance.
- no verified quote — Use an empty quotes array rather than inventing, paraphrasing or misattributing a voice.
Forum material is used only as evidence of real questions, language and experience. Every quotation must be confirmed at its original URL with its date and context. A forum comment is labelled as sentiment or practitioner experience and is never used as proof of New Zealand law, regulatory policy, technical compliance or prevalence. When no suitable quotation can be verified, none is included.
What common research failures does the clean-room method prevent?
The method is designed to prevent source laundering, where a secondary article is cited for a claim that it cannot authoritatively establish; jurisdiction leakage; stale legislation; treating a Bill or announcement as law; presenting regulator guidance as statutory wording; collapsing sector-specific duties into universal SME rules; inventing quotations; attributing a paraphrase as verbatim; citing a homepage instead of the supporting passage; copying figures without dates or definitions; and using a source that no longer resolves. It also prevents legal overstatement, such as calling OPC's ideal 72-hour window the exact statutory wording, or stating that every SME is required to hold a document with a prescribed title when the law instead requires an outcome. Technical recommendations are not labelled mandatory unless law, contract or applicable authority makes them so. The final file is also checked for schema compliance, exact question count, CTA structure, plain URLs and consistency between claims, obligations and source lists.
- authority failure — Secondary commentary, marketing pages or anonymous posts are substituted for available primary sources.
- status and scope failure — Proposals, repealed rules, sector duties or guidance are misstated as universal current law.
- citation failure — The URL is dead, generic, mismatched or does not contain the proposition or quotation.
- content-integrity failure — Claims are overstated, quotations invented, dates omitted or foreign terminology remains in the final New Zealand guide.
Before publication, every guide is checked for jurisdiction, source authority, legal status, sector scope, claim precision, quotation accuracy, link resolution, dates, terminology and schema compliance. Unsupported or overbroad claims are narrowed, marked INFERRED or removed. Guidance is not described as statutory wording, proposals are not described as enacted law and foreign instruments are not presented as New Zealand authority.
What's my next step?
Common misconceptions
- Clean-room research means the writer cannot read foreign material. Foreign material may be used for an expressly labelled comparison, but it cannot silently supply New Zealand law or official guidance. INFERRED
- A source is authoritative merely because it appears high in search results. Authority depends on issuer, jurisdiction, legal status, scope and currency. INFERRED
- A Bill, consultation paper or government announcement is already law. New Zealand Legislation distinguishes proposed Bills from enacted Acts and identifies whether legislation is in force. VERIFIED
- VERIFIED means the site agrees with a claim. It means the cited source directly supports the material factual proposition. INFERRED
- INFERRED means a claim is fabricated or unreliable. It means editorial reasoning is disclosed because the conclusion is not stated directly by the source. INFERRED
- New Zealand's breach-notification statute states a fixed 72-hour deadline. The Act says as soon as practicable; OPC says notification should ideally occur within 72 hours. VERIFIED
- New Zealand privacy law uses the Australian APPs and OAIC process. New Zealand uses the Privacy Act 2020, Information Privacy Principles and Office of the Privacy Commissioner. INFERRED
- The Essential Eight, SMB1001 and ASD ISM are official New Zealand cyber frameworks. New Zealand government guidance is published through NCSC, Own Your Online and the government-focused NZISM. INFERRED
- NZISM automatically binds every private New Zealand SME. It is intended for government agencies and organisations, while other organisations are encouraged to use it. VERIFIED
- A forum quotation can establish what New Zealand law requires. Forum material is useful for real-world language and concerns but is not a substitute for legislation or an official authority. INFERRED
- A link to an authority's homepage makes a claim checkable. The cited page should contain the proposition and preserve its legal status, scope and date. INFERRED
- A genuine sector rule can be applied to every business. Sector-specific requirements must remain limited to the entities and events within their legal or regulatory scope. INFERRED
- CERT NZ remains a separate current New Zealand operational cyber authority. Its integration into the NCSC was completed in July 2025. VERIFIED
Obligations at a glance
The obligations most relevant to this guide, with the regulator, the trigger and the timeframe. Follow the source links in the appendix for the authoritative wording.
| OBLIGATION | REGULATOR | TRIGGER | TIMEFRAME | PENALTY |
|---|---|---|---|---|
| Privacy Act 2020 IPP 5 reasonable security safeguards | Office of the Privacy Commissioner | A New Zealand agency holds personal information. | Ongoing while the information is held and whenever systems, suppliers, uses, access arrangements or risks change. | |
| Privacy officer appointment | Office of the Privacy Commissioner | The entity is a business or organisation that is an agency under the Privacy Act. | Maintain at least one person fulfilling the privacy-officer role on an ongoing basis. | |
| Notify the Privacy Commissioner of a notifiable privacy breach | Office of the Privacy Commissioner | It is reasonable to believe that a privacy breach has caused serious harm to an affected individual or is likely to do so. | Notify as soon as practicable after becoming aware that the breach is notifiable; OPC says ideally within 72 hours even if investigation continues. | Failure without reasonable excuse to notify the Commissioner is an offence punishable by a fine not exceeding NZD 10,000. |
| Notify affected individuals of a notifiable privacy breach | Office of the Privacy Commissioner | A notifiable privacy breach affects an individual and no applicable public-notice provision, statutory exception or permitted delay displaces immediate individual notification. | Notify affected individuals as soon as practicable in accordance with sections 115 to 117 of the Privacy Act. | Failure to notify an affected individual or give required public notice may constitute an interference with privacy. |
Sources
- New Zealand Legislation primary
- About Acts primary
- About Bills primary
- About legislation status primary
- New Zealand Legislation glossary primary
- Privacy Act 2020 primary
- Employment Relations Act 2000 primary
- Companies Act 1993 primary
- Privacy Act 2020 information privacy principles primary
- Privacy Act Principle 5 — Storage and security of information primary
- Complying with the Privacy Act primary
- Information for privacy officers primary
- Sorting out privacy breaches primary
- NotifyUs of a serious privacy breach primary
- IPP 3A notification requirements for indirect collection primary
- NCSC Cyber Security Framework primary
- NCSC Critical Controls: Summary primary
- NCSC Protect your organisation primary
- New Zealand Information Security Manual primary
- NCSC and CERT NZ integration now complete primary
- Create an online security policy for your business primary
- Own Your Online business guidance primary
- Office of the Privacy Commissioner primary
This guide and its templates are a professionally drafted starting point, not legal advice. Your obligations depend on your industry, your contracts and your data. Have a qualified adviser review anything high stakes before you rely on it.