# Privacy report to [the board / leadership team]

**Period:** [1 January to 30 June 2027]
**Prepared by:** [privacy officer]
**Date:** [date]

## 1. Decisions needed

[List anything the board needs to decide or approve: budget, accepting a risk, approving the privacy plan. If none, say so.]

## 2. Summary

[Three or four sentences. Overall position, the biggest risk, the biggest improvement.]

## 3. Measures

| Measure | This period | Last period | Comment |
| --- | --- | --- | --- |
| Breaches and near misses recorded | | | |
| Breaches notified to the Privacy Commissioner | | | |
| Access and correction requests received | | | |
| Requests answered within 20 working days (%) | | | |
| Privacy complaints received | | | |
| Complaints escalated to the Privacy Commissioner | | | |
| Staff who completed privacy training (%) | | | |
| New projects or suppliers assessed (PIA or threshold check) | | | |
| Self-check score (annual) | | | |

## 4. Incidents

[For each notifiable breach or significant incident: what happened, how many people, what we did, what's changed. Keep it factual.]

## 5. Key risks

| Risk | Rating | Mitigation | Owner |
| --- | --- | --- | --- |
| | | | |

## 6. Legal and regulatory changes

[Anything new that affects us. For example: IPP 3A (indirect collection) in force from 1 May 2026; Biometric Processing Privacy Code applies to all processing from 3 August 2026; director address protections from 18 November 2026.]

## 7. Privacy plan progress

| Action | Owner | Due | Status |
| --- | --- | --- | --- |
| | | | |

---
From Faraday, faraday.co.nz/templates/board-privacy-report/ (CC BY 4.0). Checked against New Zealand sources on 19 October 2026. General information, not legal advice.