Board privacy report
A two-page report template for leadership or the board, twice a year. Covers the measures that matter and the decisions leaders need to make.
- Checked against sources
- Licence
- CC BY 4.0, free to adapt
- Sources
- 2 cited
Remove the guidance notes in square brackets before you publish.
How to use this
The Privacy Commissioner’s first pou is governance, meaning leaders who understand and oversee privacy risk. A short report twice a year is the simplest way to show that. Keep it to two pages. Lead with the decisions you need from the board.
Privacy report to [the board / leadership team]
Period: [1 January to 30 June 2027] Prepared by: [privacy officer] Date: [date]
1. Decisions needed
[List anything the board needs to decide or approve: budget, accepting a risk, approving the privacy plan. If none, say so.]
2. Summary
[Three or four sentences. Overall position, the biggest risk, the biggest improvement.]
3. Measures
| Measure | This period | Last period | Comment |
|---|---|---|---|
| Breaches and near misses recorded | |||
| Breaches notified to the Privacy Commissioner | |||
| Access and correction requests received | |||
| Requests answered within 20 working days (%) | |||
| Privacy complaints received | |||
| Complaints escalated to the Privacy Commissioner | |||
| Staff who completed privacy training (%) | |||
| New projects or suppliers assessed (PIA or threshold check) | |||
| Self-check score (annual) |
4. Incidents
[For each notifiable breach or significant incident: what happened, how many people, what we did, what’s changed. Keep it factual.]
5. Key risks
| Risk | Rating | Mitigation | Owner |
|---|---|---|---|
6. Legal and regulatory changes
[Anything new that affects us. For example: IPP 3A (indirect collection) in force from 1 May 2026; Biometric Processing Privacy Code applies to all processing from 3 August 2026; director address protections from 18 November 2026.]
7. Privacy plan progress
| Action | Owner | Due | Status |
|---|---|---|---|
Sources
Something wrong or out of date? Tell us or edit this page on GitHub. General information, not legal advice.