Staff privacy essentials checklist

How to use this

The privacy officer works through this checklist for each new staff member, and once a year for everyone. It covers what people need to know to avoid the mistakes behind most real breaches. For training itself, use the Privacy Commissioner’s free e-learning or your organisation’s usual training provider.

Staff privacy essentials

Owner: [privacy officer] Review: [annually]

When someone starts

• [ ] They know who the privacy officer is and how to reach them: [name, email, phone].
• [ ] They have a copy of the four rules below.
• [ ] They know how to report a suspected breach, including after hours.
• [ ] They know to forward any request for personal information to the privacy officer the same day.
• [ ] They’ve completed [the Privacy Commissioner’s free e-learning / our training provider’s privacy module].
• [ ] Their system access matches what their role needs.

The four rules

1. Only look at what you need for your work. Looking up a neighbour, an ex or a celebrity in our systems is a breach, even if you never tell anyone.
2. Check before you send. Most serious mistakes involve email, such as the wrong recipient from autocomplete, the wrong attachment, or CC instead of BCC. Pause before sending anything with personal information.
3. Keep it in our systems. Don’t move work information into personal email, personal cloud storage, personal phones or unapproved AI tools.
4. Lock it up. Lock your screen when you step away. Don’t leave paperwork out. Use multi-factor authentication.

What everyone should know about breaches

• A breach is when personal information is seen, sent, changed, lost or destroyed when it shouldn’t be, or when we can’t get to it.
• If you think one has happened, tell [privacy officer] immediately, including after hours. Don’t try to fix it quietly, and don’t wait until you’re sure.
• We have a short window to assess breaches and tell the Privacy Commissioner if they’re serious, so speed matters more than blame.
• People who report their own mistakes quickly won’t be punished for reporting.

What everyone should know about requests

• Anyone can ask to see or correct the information we hold about them, without mentioning privacy law.
• Forward these requests to [privacy officer] the same day. We have 20 working days to respond.

Each year

• [ ] Everyone has been reminded of the four rules and how to report a breach.
• [ ] Teams handling sensitive information have had training specific to their work, through [provider].
• [ ] Completion is recorded for the board privacy report.