New research indicates personal information given to big government agencies and businesses is ending up overseas, with few checks on how it is then being used.
The Privacy Commission has asked most government departments and a number of large companies, including banks, Air New Zealand and Fonterra, about what they do with information given to them by the public.
About half the 50 agencies say they send it offshore for processing or storage, often without people knowing this is being done.
Privacy Commissioner Marie Shroff says in a global digital environment there are risks of hacking or accidental leaking.
She says many of the businesses are not highly aware of what happens once the information goes overseas.
"Some of them - a signficant minority - even say they don't have any control over that information, and they don't check it, they don't know how long it's retained by the overseas agency and they don't know how it's used."
Ms Shroff says this can leave the way open for data to be sold to places like marketing agencies.