Do I Need A Data Sharing Agreement With Contractors?

Bringing in an external contractor can make life much easier. You might hire a marketing freelancer to run email campaigns, an IT consultant to manage your systems, or a bookkeeper to process payroll.

But the moment that contractor can see your customer list, employee records, invoices, CRM, shared drive or platform logins, you need to think about privacy and confidentiality.

The good news is that this doesn't have to be complicated. A clear contractor agreement, with the right privacy and data processing clauses, can help you stay compliant under the Privacy Act 2020 and reduce the chance of a messy data issue later.

Do I Need A Data Sharing Agreement With Contractors?

Usually, yes, if your contractor will access, use, store or handle personal information for your business.

A data sharing agreement isn't always a separate standalone document. For many New Zealand businesses, the same job can be done through strong privacy, confidentiality and data handling clauses inside your contractor agreement, services agreement or data processing agreement.

What matters isn't the title of the document. What matters is whether it clearly covers:

• what personal information the contractor can access
• why they can access it
• how they must protect it
• whether they can share it with anyone else
• what happens when the work ends
• what they must do if there's a privacy breach or access request

Under the Privacy Act 2020, your business is usually responsible for how personal information is collected, used, stored and disclosed in your operations. If you give a contractor access to that information, you should have a written agreement that sets the rules.

For example, say you run an online skincare store in Auckland and you hire a freelance email marketer. You give them access to your customer names, email addresses, purchase history and abandoned cart data. That's personal information. You would want written terms saying they can only use that information to run your campaigns, not for their own mailing list, other clients or side projects.

What Counts As Sharing Personal Information With A Contractor?

Sharing personal information with a contractor means giving them access to information that identifies a person, or could reasonably identify them.

This can happen even if you don't send them a spreadsheet. Access to a platform, folder or system can still count.

Common examples include sharing:

• customer names, email addresses, phone numbers or delivery addresses
• customer order history, preferences, support tickets or complaints
• employee files, payroll information, leave records or performance notes
• contractor or supplier contact details
• login credentials, CRM access, helpdesk access or admin permissions
• booking records, health information or other sensitive details
• analytics data that can be linked back to an individual

Some information is more sensitive than other information. Health information, financial details, employee records and information about children usually need extra care, including clear rules for sensitive information.

Even ordinary customer contact details can create risk if they're copied, misused or left exposed. If a contractor accidentally downloads your customer list to a personal laptop with weak security, your business may be the one dealing with the fallout.

Does The Privacy Act 2020 Apply To Contractors?

Yes, the Privacy Act 2020 can apply to contractors, and it will usually apply to your business when you share personal information with them.

The Act is built around the Information Privacy Principles. These principles cover things like collection, use, disclosure, storage, access, correction and overseas disclosure of personal information.

For outsourcing arrangements, the key practical duties are usually:

• only collect personal information you need for a lawful purpose connected to your business
• tell people what you're collecting and why, where the Act requires this
• use personal information only for the purpose it was collected, unless an exception applies
• keep personal information safe from loss, unauthorised access or misuse
• limit disclosure to contractors and service providers who genuinely need it
• take care when personal information is sent or stored overseas
• respond properly to privacy breaches that may cause serious harm

The Privacy Commissioner can investigate privacy complaints and serious privacy incidents. If your customer data is exposed because a contractor had poor controls, you may need to notify affected people and the Privacy Commissioner if the breach has caused, or is likely to cause, serious harm.

That's why privacy clauses aren't just admin. They give you a clear process if something goes wrong.

You should be especially careful with overseas arrangements. IPP 12 may apply where you disclose personal information to an overseas contractor or organisation. However, sending information to an overseas agent purely for storage or processing on your behalf may not be treated as a disclosure under the Act, though you remain responsible for ensuring the information is handled properly.

In many cases where IPP 12 applies, you need to take reasonable steps to check the overseas recipient is subject to privacy safeguards that are comparable to the New Zealand Privacy Act, or rely on another permitted basis. For example, if you hire a virtual assistant based overseas to manage customer service emails, you should check where the data will be accessed from, whether they use subcontractors, what systems they use, and what information security commitments they can make in writing.

Is A Contractor Confidentiality Data Clause Enough?

Sometimes, yes, but only if the clause is detailed enough for the actual data risk in your arrangement.

A basic confidentiality clause that says the contractor must keep your information confidential is useful, but it may not cover everything you need. Confidentiality is mainly about not revealing information to others. Privacy and data handling clauses go further. They explain how personal information can be used, stored, accessed, returned, deleted and protected.

For a low risk job, such as a contractor who only sees a limited contact list for one short project, a well drafted confidentiality and privacy clause in the contractor agreement may be enough.

For higher risk work, you may need more detailed terms, or a separate data processing agreement. This is more likely if the contractor will:

• handle large volumes of customer or employee information
• access sensitive information, such as health, finance or HR records
• connect to your systems through admin or developer access
• use subcontractors or offshore team members
• store personal information in their own tools or cloud accounts
• make decisions about how data is used, rather than just following your instructions

The higher the risk, the more specific your agreement should be. Vague wording can make it hard to enforce your rights, work out who is responsible, or respond quickly if a breach happens.

What Should Your Agreement Include?

Your contractor agreement or data sharing terms should be practical. The goal is to make it clear what the contractor can and can't do with the information they receive.

Useful clauses often cover:

• Purpose: the contractor can only use personal information to provide the agreed services.
• Access limits: the contractor should only access the information they reasonably need.
• Security: the contractor must use appropriate safeguards, such as strong passwords, multi factor authentication, secure devices and restricted access.
• Subcontractors: the contractor can't share information with subcontractors or third parties unless you approve it, and those parties are bound by suitable privacy and confidentiality duties.
• Overseas access: the contractor must tell you if information will be accessed, stored or processed overseas, so you can consider the Privacy Act requirements.
• Breach reporting: the contractor must tell you quickly if there's unauthorised access, loss, misuse or disclosure of information.
• Access and correction requests: the contractor must help you respond if a customer or employee asks to access or correct their personal information.
• Return or deletion: the contractor must return, securely delete or destroy personal information when the project ends, unless you agree otherwise.
• Audit and cooperation: for higher risk arrangements, you may want a right to ask for evidence of security practices or require cooperation with investigations.

You should also make sure your own privacy policy matches what is actually happening. If your privacy policy says you only share customer information with New Zealand based providers, but your contractor is using an offshore support team, that inconsistency can create problems.

What Should You Do In Practice?

Before giving a contractor access, map out what they really need. Many privacy issues start because a contractor is given broader access than the job requires. If a designer only needs product photos, they probably don't need access to your whole customer database.

Next, check the contractor's tools and habits. Ask where they store files, who can access them, whether they use personal devices, and whether they use subcontractors. These questions don't need to feel adversarial. They're normal business checks when someone is handling important information for you.

Then, put the rules in writing before access is granted. It's much easier to agree on privacy expectations at the start than after a breach, complaint or relationship breakdown.

Finally, remove access when the work ends. Disable logins, change shared passwords, collect files and confirm deletion where appropriate. Offboarding is one of the simplest ways to reduce ongoing privacy risk.

Key Takeaways

• If a contractor can access personal information, you should usually have written privacy and data handling terms in place.
• A separate data sharing agreement isn't always necessary, but your contractor agreement must clearly cover privacy, confidentiality, security and breach processes.
• The Privacy Act 2020 can apply when contractors handle personal information for your business, including in some overseas disclosure arrangements.
• Confidentiality clauses are helpful, but higher risk arrangements often need more detailed data processing obligations.
• Limit contractor access to what they need, check their systems, and remove access when the work ends.

If you'd like help with contractor agreements, privacy clauses, data processing terms or privacy breach processes, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.