Drone operations generate enormous amounts of sensitive data—high-resolution imagery, thermal signatures, location coordinates, building measurements. This data is valuable but highly sensitive. New Zealand's Privacy Act 2020 (plus international regulations like GDPR if you have EU clients) strictly governs how you collect, store, use, and share this information. Violating these rules can result in fines up to NZ$10,000 (individual) or NZ$50,000 (organisation) under the Civil Aviation Act 1990 (individual maximum under the Civil Aviation Act 1990) and civil liability.
The Legal Framework: Three Layers of Data Protection
Data Breach Response: What to Do
If Personal Data Is Accidentally Exposed
Immediate Actions (Within 72 hours):- Contain the breach: Limit further access/exposure
- Investigate: How did breach occur? What data exposed? Who's affected?
- Notify affected individuals: (GDPR requires this; Privacy Act doesn't mandate, but good practice)
- Notify Privacy Commissioner: If serious (NZ law requires notification for serious breaches)
` PRIVACY INCIDENT NOTIFICATION Dear [Individual], We experienced a data security incident affecting roof inspection photos from your property at [Address] taken on [Date]. Incident: Cloud storage misconfiguration exposed photos publicly for 4 hours before discovery. Your Data Exposed: High-resolution roof images, thermal data. Actions Taken: Cloud account re-secured, photos removed, access control tightened. Your Rights: Contact us at [email] to request we delete your data immediately. Sincerely, [Company Name] ``
Privacy Commissioner Investigation
If you fail to notify or handle breach poorly:
- Commissioner initiates investigation (6–12 months typical)
- May issue compliance order requiring specific actions
- Fine up to NZ$10,000 (individual maximum under the Civil Aviation Act 1990) for serious breaches
- Individual can sue for damages (emotional distress, financial loss)
Tools & Best Practices for Data Protection
Encryption Tools
- Whole Disk Encryption: BitLocker (Windows) or FileVault (Mac)
- Cloud Storage: Google Drive, Dropbox with verified encryption
- File Encryption: 7-Zip with AES-256, VeraCrypt for sensitive archives
- Communication: ProtonMail for encrypted email (if sharing data)
Access Control
- Strong Passwords: 16+ character, mixed case/numbers/symbols
- Multi-Factor Authentication: 2FA on all accounts
- VPN: Use when accessing data remotely
- Shared Drives: Use role-based permissions (read-only vs. edit)
Documentation
- Data inventory: Log all data collected (type, purpose, subjects, retention period)
- Consent records: Keep signed forms for 7+ years
- Processing log: Document how data is used and accessed
- Incident log: Record any security concerns or near-misses
Staff Training
- Onboarding: Privacy obligations explained to all crew
- Annual refresh: Privacy Act/GDPR updates communicated
- Incident response: Clear protocol if data exposed
- Contractor agreements: All subcontractors sign data protection clause
Frequently Asked Questions
Piyo: If I blur faces in my drone footage, does Privacy Act still apply?
No. If faces truly unidentifiable, that's not personal data. But ensure blurring is effective—pixelation at distance may still allow recognition.
Poppo: Can I use a client's drone footage for my portfolio/marketing without asking again?
No. Initial consent was for "property inspection." Reuse requires new consent. Collect consent to use as portfolio examples in initial consent form.
Piyo: What's the difference between Privacy Act and GDPR for my New Zealand business?
Privacy Act applies to all NZ operations. GDPR applies ONLY if you handle EU resident data. If all clients are NZ-based, Privacy Act sufficient.
Poppo: If I use cloud storage (Google Drive, Dropbox), am I compliant?
Provider compliance (encryption, access control) doesn't automatically make YOU compliant. You still must: get consent, limit retention, control access, document security.
Piyo: How long should I keep drone data?
Privacy Act says "no longer than necessary." Varies by purpose: real estate (6–12 months), inspection (7 years claim period), agricultural (2 seasons), construction (1 year post-project).
Automate Data Protection Compliance with MmowW
Managing consent forms, data retention schedules, and breach response protocols is complex. MmowW automates data protection workflows, retention scheduling, and breach notification procedures at just NZ$8.60 per drone per month. With MmowW, you get:
- Digital consent form management (e-signature integrated)
- Automated data retention scheduling (delete reminders, auto-purge)
- Access logging (who viewed what data, when)
- Breach response templates and notification procedures
- Privacy compliance audit trails (ready for commissioner investigations)