Privacy officer role description

How to use this

Every agency must have a privacy officer (Privacy Act 2020, s 201), and the role can be filled by someone outside the organisation. In most small organisations it’s part of someone’s job. The most common failure is appointing someone with no time or authority, so the hours and authority sections matter as much as the duties.

Privacy officer: role description

Organisation: [name] Reports to: [CEO / board chair / general manager] Time allocated: [for example, 4 hours a week, increasing during incidents] Appointed: [date]

Purpose

The privacy officer helps [organisation] meet its obligations under the Privacy Act 2020 and any codes of practice that apply to us, and is the main point of contact for privacy matters inside and outside the organisation.

Responsibilities

Legal duties under the Privacy Act

• Encourage [organisation] to comply with the information privacy principles.
• Deal with requests for access to and correction of personal information.
• Work with the Privacy Commissioner on investigations and inquiries involving us.
• Otherwise ensure [organisation] complies with the Act.

In practice

• Keep the personal information inventory and retention schedule current, with information owners.
• Lead breach response, including assessment, notification decisions with the decision-maker, and records.
• Run the access and correction request process and keep the request log.
• Review privacy impact assessments for new projects, suppliers and AI tools.
• Maintain the privacy statement and collection notices.
• Arrange privacy induction and refresher training.
• Report to leadership at least twice a year.
• Keep up with changes in privacy law and guidance.

Authority

The privacy officer has authority to:

• access any system or record needed to respond to a request or investigate a breach
• require staff to report suspected breaches immediately, and to cooperate with breach response
• pause a project or supplier onboarding pending a privacy impact assessment, escalating to [role] if there’s disagreement
• speak to the Privacy Commissioner’s office on [organisation]'s behalf

Skills

• Sound judgement and discretion with confidential matters.
• Clear writing for both staff and the public.
• Working knowledge of the Privacy Act, or willingness to complete the Privacy Commissioner’s free e-learning within the first month.

Outsourcing the role

If an external provider fills the role, the appointment letter should cover the hours and response times included and how staff contact them. It should also set out their authority as above, who inside the organisation acts as the day-to-day contact, conflict-of-interest arrangements if they serve other organisations, and confidentiality.

Contact details published

[Name or role], [email], [phone]. Published in our privacy statement and on our website.