Guides for organisations
The Privacy Act 2020 applied to real New Zealand situations. Written for the person who got handed privacy on top of their actual job.
- Guides
- 12
- Templates
- 15 to adapt
- Regulator's framework
- Poupou Matatapu
Guides
- The Privacy Act 2020 in plain languageThe fourteen privacy principles, what each one asks of you in practice, and what the Privacy Commissioner can do if you get it wrong.
- A privacy programme for a small organisation, in 90 daysA week-by-week plan for the person who has just been made privacy officer at a business, charity or school with no privacy budget. Mapped to the Commissioner's Poupou Matatapu.
- Responding to a privacy breach in the first 72 hoursWhat to do, in what order, from the moment someone says "I think I sent that to the wrong person" to the notice you send affected people.
- Telling people when you collect their information from others (IPP 3A)The rule that started on 1 May 2026, the common collections it catches, the exceptions, and a method for getting compliant without rewriting everything.
- Who the Biometric Processing Privacy Code covers, and what to doFingerprint timeclocks, face recognition, voice verification. Since 3 August 2026 the code applies to every biometric system in New Zealand, old and new. A practical guide.
- Responding to requests for personal informationHow to handle an access or correction request properly, on time, without releasing someone else's information by mistake.
- Suppliers, cloud services and sending information overseasWhen a supplier holds your data you are still responsible for it. How section 11 and IPP 12 work, and what to put in contracts.
- CCTV, cameras and monitoring staffHow the Privacy Act applies to security cameras, body cameras, number plate recognition and monitoring employees' devices and activity.
- Using AI tools at work without breaking the Privacy ActWhat the Privacy Commissioner expects before staff paste customer or staff information into AI tools, and a simple set of rules you can adopt this week.
- Māori data, privacy and governanceWhy privacy compliance alone doesn't cover your responsibilities for Māori data, and practical steps for organisations that hold it.
- Data governance for organisations without a data teamWho decides what about your organisation's information, written down on one page. Roles, decisions and routines that keep privacy working after the project ends.
- Privacy for clubs, charities, marae and community groupsVolunteer-run groups hold membership lists, contact details, children's information and sometimes health information. The Privacy Act applies, and a few habits cover most of it.