Free versus paid
What New Zealand privacy consultancies typically sell, the free equivalent on this site or from the regulator, and when paying a professional is worth it.
- Sources
- 8 cited
We reviewed the privacy services advertised by New Zealand consultancies, accounting and advisory firms, cyber security companies and law firms. This table maps the common services to free alternatives. Good advisers add real value. This page is here so you can decide what you need to buy.
| Service commonly sold | Free alternative | Pay a professional when |
|---|---|---|
| Privacy policy or statement drafting | Privacy statement template, collection notices, the Commissioner’s Privacy Statement Generator | You operate in several countries or under several regimes at once |
| Privacy gap analysis or audit | Privacy self-check, 90-day programme | A board, funder or client needs independent assurance |
| Privacy maturity assessment | Privacy self-check; for government, the PMAF | You need benchmarking against other organisations |
| Privacy impact assessment | PIA template, biometric worksheet | The project is high-risk: biometrics, AI decisions about people, large-scale data matching, children, health |
| Data mapping and inventory | Inventory and interview guide | You have hundreds of systems and need tooling |
| Retention schedules | Retention schedule | You’re subject to the Public Records Act or complex sector rules |
| Breach response planning | Breach response plan and register, breach assessment record | You want a facilitated exercise with experienced incident responders |
| Breach response | Breach response guide, NCSC on 0800 114 115 | Always, for a serious cyber attack: forensics, legal advice, communications |
| Supplier or third-party risk review | Supplier questionnaire | The supplier is critical and you need technical security testing |
| Staff training | 30-minute induction, the Commissioner’s free e-learning | You need role-specific training for high-risk teams |
| Outsourced privacy officer | Privacy officer role description, and all the tools on this site | Nobody inside has the time, or you need senior experience during a crisis |
| Access request handling | Procedure and log, deadline calculator | A request is part of a legal dispute |
| AI governance | AI at work guide, AI use policy | You’re building AI products or using AI to make decisions about people |
| Personal privacy and exposure reduction | Personal exposure audit, public registers guide | You face an active, determined threat and need hands-on help (start with Police and an advocate) |
| Representation before the Privacy Commissioner or Tribunal | Your rights, Community Law centres (free) | Always consider a lawyer for Tribunal proceedings |
Free help from public bodies
- Office of the Privacy Commissioner: guidance including Poupou Matatapu, NotifyUs for breaches, e-learning, and an enquiries line.
- National Cyber Security Centre: incident reporting and help on 0800 114 115, and Own Your Online for individuals and small businesses.
- Netsafe: online harm, scams and harmful digital communications, on 0508 638 723.
- Community Law centres: free legal help, including on privacy and harassment.
- Citizens Advice Bureau: free advice and referrals.
Before you hire anyone
Do the self-check and the inventory first. You’ll know what you need, you’ll spend less, and you’ll be able to tell a good adviser from a template seller.
Sources
- Poupou Matatapu: doing privacy well
- Privacy Statement Generator
- Privacy Impact Assessments
- Free privacy e-learning
- Sorting out privacy breaches (including NotifyUs)
- Information for privacy officers
- What the Privacy Maturity Assessment Framework is
- Reporting cyber incidents after the CERT NZ and NCSC integration
Something wrong or out of date? Tell us or edit this page on GitHub. General information, not legal advice.