Privacy self-check for organisations

A named privacy officer has the authority and time to do the job, and staff know who it is.

Leaders or the board get privacy reporting (breaches, requests, key risks) at least twice a year.

Privacy responsibilities are written into job descriptions and supplier contracts.

We have a current list of the personal information we hold, where it lives, why we hold it and who can see it.

We know which information is sensitive and handle it with extra care.

Every type of information has a retention period, and we actually delete or destroy it on schedule.

Access to personal information is limited to people who need it, and removed promptly when they leave or change roles.

Every account that can reach personal information uses multi-factor authentication.

We can see who accessed sensitive records, and we look.

Suppliers that hold our data were checked before we signed, and their contracts cover security and breach notification.

Our privacy statement is accurate, in plain language, and covers information we collect from others (IPP 3A).

Forms and sign-up flows have a short notice at the point of collection.

We tell people before we use their information for a purpose they wouldn't expect.

Every staff member gets a privacy induction and a yearly refresher.

Staff know what a breach looks like and how to report one quickly.

Teams handling sensitive information get training specific to their work.

We have a written breach response plan with named roles, and we've practised it in the last year.

We record every incident and near miss in a breach register, with the decision and reasons.

We could notify the Privacy Commissioner and affected people within 72 hours of finding a serious breach.

We log access and correction requests and answer them within 20 working days.

Staff recognise a request for personal information even when it doesn't mention the Privacy Act.

We have a written complaints process and we use complaints to improve.

We do a privacy impact assessment, or at least a threshold check, before new projects, suppliers or AI tools.

Privacy risks sit in our risk register with owners.

Any biometric processing has been assessed against the Biometric Processing Privacy Code.

We track a few privacy measures, such as requests answered on time, breaches and training completion.

We check ourselves against a framework like this one at least once a year.

Breaches and complaints lead to changes we can point to.

We have a written privacy plan with goals, owners and dates.

The plan has a budget or time allocation, and someone reviews progress.