Pay for judgement, not for templates
What New Zealand organisations usually pay privacy consultants for, which parts you can now do yourself for free, and which parts are worth paying for.
- Published
- Written by
- Faraday
- Sources
- 5 cited
We looked at what privacy consultancies, accounting firms, cyber security firms and law firms in New Zealand offer. The menus are remarkably similar. Most offer privacy policy drafting, privacy impact assessments, gap analyses and audits, maturity assessments, training, breach response planning, supplier risk reviews, and outsourced privacy officers.
Some of that work needs years of experience. Most of the rest needs someone who understands the organisation, a clear method and a good template. The organisation already has the first. We’ve published the other two.
What you can now do yourself
| What’s usually sold | The free version |
|---|---|
| Privacy policy drafting | Our privacy statement template and collection notices, plus the Commissioner’s own generator |
| Gap analysis or maturity assessment | Our privacy self-check, organised by the Commissioner’s Poupou Matatapu |
| Privacy impact assessment | Our PIA template, with a threshold check and principle-by-principle assessment |
| Breach response planning | Our breach response plan, register and assessment record |
| Supplier privacy review | Our supplier questionnaire and contract checklist |
| Staff training | Our 30-minute induction, and the Commissioner’s free e-learning |
| Data mapping | Our personal information inventory and interview guide |
| Personal exposure review | Our personal exposure audit |
What’s still worth paying for
Legal advice and representation. If you’re facing a complaint the Commissioner is investigating, Tribunal proceedings, or a dispute over whether a disclosure was lawful, you want a lawyer.
Incident response. After a cyber attack you need forensic investigators who can work out what was taken, preserve evidence and get you running safely. Call the NCSC and your insurer first.
High-risk assessments. A PIA for facial recognition, large-scale data matching, AI decisions about people, or a national health system deserves an experienced reviewer, even if you write the first draft.
Independent assurance. Sometimes you need someone outside the organisation to say it’s sound, for a board, a funder or a client.
Time. If nobody in your organisation has the hours, paying someone can be the right call. You’ll get far more for your money if you’ve done the inventory and self-check first, because you’ll be paying for judgement rather than discovery.
Questions to ask before you hire anyone
- Will you use our inventory and self-check results, or start from scratch?
- Who will actually do the work, and what’s their New Zealand privacy experience?
- What will we own at the end? Can we update the documents ourselves?
- Is this a fixed price?
- How will you handle our information while you work on it?
A good adviser will be glad you’ve done the groundwork. Our full comparison is on the free versus paid page.
Sources
Something wrong or out of date? Tell us or edit this page on GitHub. General information, not legal advice.