Thirty-minute staff privacy induction

How to use this

Run it in person or on a call for new staff, and as a yearly refresher. It’s built around the mistakes that cause most real breaches. Replace the bracketed parts with your own examples. Point people to the Privacy Commissioner’s free e-learning if they want more.

Staff privacy induction (30 minutes)

1. Why this matters here (5 minutes)

• Explain what personal information [organisation] holds: [customers’ contact and payment details / clients’ case notes / students’ records / staff files].
• Personal information is anything about an identifiable person, including opinions, photos, recordings and notes.
• Say who the privacy officer is and how to reach them: [name, email, phone].

Ask the group: “What’s the most sensitive information you’ll handle in your job?”

2. The four rules (10 minutes)

1. Only look at what you need for your work. Looking up a neighbour, an ex or a celebrity in our systems is a breach, even if you never tell anyone.
2. Check before you send. Most serious mistakes involve email, such as the wrong recipient from autocomplete, the wrong attachment, or CC instead of BCC. Pause before sending anything with personal information.
3. Keep it in our systems. Don’t move work information into personal email, personal cloud storage, personal phones or unapproved AI tools.
4. Lock it up. Lock your screen when you step away. Don’t leave paperwork out. Use multi-factor authentication.

3. Reporting a breach (10 minutes)

• A breach is when personal information is seen, sent, changed, lost or destroyed when it shouldn’t be, or when we can’t get to it.
• If you think it’s happened, tell [privacy officer] immediately, including after hours. Don’t try to fix it quietly. Don’t wait until you’re sure.
• We have a short window to assess breaches and tell the Privacy Commissioner if they’re serious. Speed matters more than blame.
• People who report their own mistakes quickly won’t be punished for reporting.

Scenario: “You’ve just emailed a spreadsheet of client names and phone numbers to the wrong person outside the organisation. What do you do in the next five minutes?” (Answer: tell the privacy officer, try to recall it, ask the recipient to delete it and confirm.)

4. Requests from the public (3 minutes)

• If anyone asks to see information we hold about them, or to correct it, forward it to [privacy officer] the same day, even if they don’t mention privacy law.
• We have a legal deadline of 20 working days to respond.

5. Questions and sign-off (2 minutes)

Record attendance. Give everyone a copy of the four rules and the privacy officer’s contact details.