Jobs could be on the line following a highly critical report into how the Ministry of Social Development (MSD) stores client information.
In March this year, the ministry announced community groups, such as Women's Refuge, would have to hand over people's personal data if they wished to get funding.
Some data was stored in a temporary IT system, but that was shut down in April following a privacy breach in which one ministry contractor was able see information sent in by another.
While no unauthorised services actually looked at the information, the independent review said the IT project lacked proper leadership and resourcing, and its security risks had not been properly checked or tested.
Social Development Minister Anne Tolley said she was disappointed by the report's criticism and the ministry was carrying out an employment investigation.