A privacy programme for a small organisation, in 90 days

This is the plan we’d follow if we walked into a 20-person organisation with no privacy programme and a privacy officer who also does three other jobs. It uses free resources throughout. It’s mapped to the ten pou of the Privacy Commissioner’s Poupou Matatapu, because that’s the yardstick the Commissioner uses.

Aim to have the basics working within 90 days, with a plan for the rest.

Weeks 1 and 2: get your bearings

Do the self-check. Spend 15 minutes on our privacy self-check with one colleague. Save the results. This is your baseline.

Do the Commissioner’s free e-learning. The modules take a few hours between them and cover the Act properly. Start with the introductory module, then any that match your sector.

Find out what’s already gone wrong. Ask the people who answer the phones and inboxes whether you’ve had complaints, requests for information, emails sent to the wrong person or lost laptops. These tell you where the real risks are.

Pou: Governance; Measure and monitor.

Weeks 3 to 5: know what you hold

You can’t protect what you don’t know you have. Use our personal information inventory and sit down with each team for 30 minutes. For each kind of personal information, record:

• what it is, and whose it is (customers, staff, volunteers, students)
• where it lives (which system, which shared drive, which filing cabinet)
• why you hold it
• who can see it
• whether you got it from the person or from someone else
• how long you keep it, and whether you ever delete it
• whether it leaves New Zealand

Most organisations find three surprises. There’s a spreadsheet nobody owns, a system holding years more data than needed, and information collected from third parties that nobody tells people about. The last one now matters more because of IPP 3A.

Pou: Know your personal information.

Weeks 6 and 7: close the obvious security gaps

Fix the things that cause most breaches:

• Multi-factor authentication on email and every system holding personal information.
• Access by role. Remove access people don’t need. Set up a leaver checklist so access ends on someone’s last day.
• Email mistakes. Most serious breaches caused by human error involve email. Turn on a delay-send or external-recipient warning, and stop sending sensitive documents as attachments where you can share a link with access controls instead.
• Laptops and phones. Encryption on, screen lock on, remote wipe ready.
• Suppliers. List the suppliers that hold your personal information. Send the important ones our supplier questionnaire.

Pou: Security and internal access controls.

Weeks 8 and 9: tell people the truth

Rewrite your privacy statement so it matches what you found in weeks 3 to 5. Use our privacy statement template or the Commissioner’s free Privacy Statement Generator, then add the specific sections for indirect collection. Add short collection notices to your forms.

Pou: Transparency.

Week 10: be ready for a breach

Adopt our breach response plan. Put names next to the roles. Set up a breach register. Then run a 30-minute tabletop exercise with a scenario like this one. “Someone emailed the client list to the wrong person at 4.45pm on a Friday. What happens next?” You’ll find the gaps in ten minutes.

Pou: Breach management.

Week 11: be ready for requests and complaints

Adopt our access request procedure and set up a request log. Make sure front-line staff can recognise a request that doesn’t mention the Privacy Act (“Can I see what you’ve got on me?”). Bookmark the deadline calculator.

Pou: Responding to requests and complaints well.

Week 12: train people

Run our 30-minute staff induction for everyone. Focus on recognising and reporting a breach quickly, and on email care. Add it to onboarding.

Pou: Building capability and awareness.

Week 13: write the plan and report

Write a one-page privacy plan for the next 12 months, listing the gaps you found, what you’ll fix, who owns each item and by when. Present it to your leaders or board with our board privacy report, and ask for the time or budget it needs.

Add a rule that any new project, supplier or AI tool gets a privacy impact assessment or at least the threshold check before it’s signed.

Pou: Privacy management plan; Assessing risk.

After 90 days

Repeat the self-check every year and compare. Review the inventory when systems change. Run the breach exercise annually. Report to leadership twice a year.

When to get outside help

Pay for help if you handle sensitive information about many people (health, children, financial, justice), if you’re planning something novel like biometrics or large-scale data matching, or if you’ve had a serious breach. Even then, doing the steps above first means you’ll spend far less, because you’ll be paying for judgement rather than for someone to discover what you hold.