The use of information technology during the COVID-19 pandemic raises significant questions around the protection of personal data in a disaster. This paper considers how the clear benefits of using and sharing such data in disaster scenarios can be achieved while recognising an individual's right to privacy through examining the experiences of Taiwan and New Zealand. These states represent two successful COVID-19 response strategies which utilised different approaches to the use of technology. In Taiwan, the response made significant use of personal data and information technology. New Zealand, by contrast, has relied upon stringent lockdowns and extreme limits upon personal freedoms. The paper considers the different approaches to data and privacy that underpinned these responses and considers whether New Zealand can learn from the Taiwanese experience in future disaster planning. In doing so, the paper concludes by examining the wider question of when and if the community's expectation of a safe environment should trump the rights of individuals to retain personal data both in the context of pandemics and in other emergency or disaster scenarios. It also raises deeper questions, exposed by the COVID-19 response, about whether our current approach to privacy is sustainable in the digital age.