# Staff privacy essentials

Owner: [privacy officer]
Review: [annually]

## When someone starts

- [ ] They know who the privacy officer is and how to reach them: [name, email, phone].
- [ ] They have a copy of the four rules below.
- [ ] They know how to report a suspected breach, including after hours.
- [ ] They know to forward any request for personal information to the privacy officer the same day.
- [ ] They've completed [the Privacy Commissioner's free e-learning / our training provider's privacy module].
- [ ] Their system access matches what their role needs.

## The four rules

1. **Only look at what you need for your work.** Looking up a neighbour, an ex or a celebrity in our systems is a breach, even if you never tell anyone.
2. **Check before you send.** Most serious mistakes involve email, such as the wrong recipient from autocomplete, the wrong attachment, or CC instead of BCC. Pause before sending anything with personal information.
3. **Keep it in our systems.** Don't move work information into personal email, personal cloud storage, personal phones or unapproved AI tools.
4. **Lock it up.** Lock your screen when you step away. Don't leave paperwork out. Use multi-factor authentication.

## What everyone should know about breaches

- A breach is when personal information is seen, sent, changed, lost or destroyed when it shouldn't be, or when we can't get to it.
- If you think one has happened, tell [privacy officer] immediately, including after hours. Don't try to fix it quietly, and don't wait until you're sure.
- We have a short window to assess breaches and tell the Privacy Commissioner if they're serious, so speed matters more than blame.
- People who report their own mistakes quickly won't be punished for reporting.

## What everyone should know about requests

- Anyone can ask to see or correct the information we hold about them, without mentioning privacy law.
- Forward these requests to [privacy officer] the same day. We have 20 working days to respond.

## Each year

- [ ] Everyone has been reminded of the four rules and how to report a breach.
- [ ] Teams handling sensitive information have had training specific to their work, through [provider].
- [ ] Completion is recorded for the board privacy report.

---
From Faraday, faraday.co.nz/templates/staff-privacy-essentials/ (CC BY 4.0). Checked against New Zealand sources on 19 October 2026. General information, not legal advice.