Templates
Policies, plans, registers and worksheets written for New Zealand law. Download, adapt, and use them. No attribution needed inside your own documents.
- Templates
- 15
- Licence
- CC BY 4.0, no attribution needed inside your own documents
- Formats
- Markdown, plus CSV for registers
Adapt, don't copy
Each template explains why each section exists. If your organisation handles sensitive information at scale, have someone experienced review what you end up with.
- Privacy statementA plain-language privacy statement for a New Zealand organisation, including a section most older statements lack, on information you collect from other people (IPP 3A).
- Collection notices for formsShort notices for sign-up forms, job applications, event registrations, enrolment forms and phone calls. Each one covers the matters IPP 3 requires.
- Privacy impact assessmentA two-stage PIA, with a ten-minute threshold check to decide whether you need one and a full assessment structured around the information privacy principles.
- Privacy breach response planA one-document plan with roles, a first-hour checklist, assessment against section 113, notification steps and a review. Comes with a breach register spreadsheet.
- Personal information inventoryA spreadsheet and interview guide for finding out what personal information you hold, where, why, and who can see it. The foundation for every other privacy task.
- Retention scheduleA starter schedule covering common record types in New Zealand organisations, with the statutory minimums we could verify and a method for setting the rest.
- Access and correction request procedureA step-by-step internal procedure for handling requests under IPP 6 and IPP 7 within 20 working days, with a request log spreadsheet.
- Supplier privacy and security questionnaireThe questions to ask any supplier that will hold or process personal information for you, and the contract terms to insist on.
- Privacy officer role descriptionWhat the privacy officer does, the authority and time they need, and how to outsource the role if that suits you better. Drop it into a job description or appointment letter.
- Board privacy reportA two-page report template for leadership or the board, twice a year. Covers the measures that matter and the decisions leaders need to make.
- Thirty-minute staff privacy inductionA facilitator's script for a short privacy session on recognising personal information, avoiding email mistakes and reporting breaches fast.
- CCTV and workplace monitoring policyA short policy for security cameras and monitoring of work systems, with a staff notice. Designed around a clear purpose, short retention and limited access.
- AI use policyA one-page policy for using generative AI tools at work, aligned with the Privacy Commissioner's expectations. Approved tools, what can go in, and human review.
- Biometric proportionality worksheetA structured worksheet for documenting whether biometric processing is necessary, effective and proportionate, with safeguards, before you use it or keep using it.
- Digital safety planA private worksheet for people worried that someone they know is monitoring or controlling them through technology. Plan what to change, in what order, and when.