# Staff privacy induction (30 minutes)

## 1. Why this matters here (5 minutes)

- Explain what personal information [organisation] holds: [customers' contact and payment details / clients' case notes / students' records / staff files].
- Personal information is anything about an identifiable person, including opinions, photos, recordings and notes.
- Say who the privacy officer is and how to reach them: [name, email, phone].

**Ask the group:** "What's the most sensitive information you'll handle in your job?"

## 2. The four rules (10 minutes)

1. **Only look at what you need for your work.** Looking up a neighbour, an ex or a celebrity in our systems is a breach, even if you never tell anyone.
2. **Check before you send.** Most serious mistakes involve email, such as the wrong recipient from autocomplete, the wrong attachment, or CC instead of BCC. Pause before sending anything with personal information.
3. **Keep it in our systems.** Don't move work information into personal email, personal cloud storage, personal phones or unapproved AI tools.
4. **Lock it up.** Lock your screen when you step away. Don't leave paperwork out. Use multi-factor authentication.

## 3. Reporting a breach (10 minutes)

- A breach is when personal information is seen, sent, changed, lost or destroyed when it shouldn't be, or when we can't get to it.
- **If you think it's happened, tell [privacy officer] immediately**, including after hours. Don't try to fix it quietly. Don't wait until you're sure.
- We have a short window to assess breaches and tell the Privacy Commissioner if they're serious. Speed matters more than blame.
- People who report their own mistakes quickly won't be punished for reporting.

**Scenario:** "You've just emailed a spreadsheet of client names and phone numbers to the wrong person outside the organisation. What do you do in the next five minutes?" *(Answer: tell the privacy officer, try to recall it, ask the recipient to delete it and confirm.)*

## 4. Requests from the public (3 minutes)

- If anyone asks to see information we hold about them, or to correct it, forward it to [privacy officer] the same day, even if they don't mention privacy law.
- We have a legal deadline of 20 working days to respond.

## 5. Questions and sign-off (2 minutes)

Record attendance. Give everyone a copy of the four rules and the privacy officer's contact details.

---
From Faraday, faraday.co.nz/templates/staff-induction/ (CC BY 4.0). Checked against New Zealand sources on 19 October 2026. General information, not legal advice.