Data Protection Impact Assessment Template for New Zealand

Start your Data Protection Impact Assessment early when planning any project that involves collecting or using personal information in new ways. This is especially important before rolling out automated decision-making systems, launching large-scale surveillance, or handling sensitive data like health records or financial information.

The Privacy Act 2020 makes these assessments particularly valuable when introducing new technologies, merging databases, or sharing data with third parties. Running this assessment during your planning phase helps identify privacy risks and necessary safeguards - saving time and resources compared to fixing privacy issues after launch. Many NZ organizations now complete these assessments during procurement of new software systems.

• Basic Assessment: Suitable for smaller organizations or low-risk projects, focusing on essential privacy principles and basic data handling practices.
• Comprehensive Review: Used for complex projects or sensitive data processing, including detailed risk matrices and mitigation strategies.
• Technology-Specific: Tailored for new IT systems or digital initiatives, with emphasis on technical security measures and data protection by design.
• Healthcare Focus: Specialized version for medical providers handling patient data under NZ health privacy codes.
• Third-Party Assessment: Modified to evaluate privacy risks when sharing data with external partners or cloud service providers.

• Privacy Officers: Lead the Data Protection Impact Assessment process, coordinating input and ensuring compliance with NZ privacy laws.
• IT Managers: Provide technical details about data processing systems and implement recommended security measures.
• Legal Teams: Review assessments for compliance with Privacy Act requirements and other relevant regulations.
• Project Managers: Integrate privacy assessment findings into project planning and implementation phases.
• External Consultants: Often brought in to provide specialist privacy expertise or independent assessment.
• Senior Management: Review and approve final assessments, allocating resources for recommended privacy controls.

• Project Scope: Document the nature, scope, and purpose of your data processing activities in detail.
• Data Mapping: List all personal information types being collected, how they'll be used, and where they'll be stored.
• Risk Analysis: Identify potential privacy risks and their likely impact on individuals.
• Stakeholder Input: Gather feedback from IT, legal, and affected business units about operational needs.
• Compliance Check: Review Privacy Act 2020 requirements and relevant industry codes.
• Mitigation Planning: Develop specific actions to address identified privacy risks.
• Documentation: Use our platform to generate a comprehensive, legally-sound assessment that meets NZ requirements.

• Project Description: Clear outline of data processing activities, their purpose, and business context.
• Data Inventory: Comprehensive list of personal information types, collection methods, and storage locations.
• Privacy Principles: Assessment against NZ Privacy Act 2020's information privacy principles.
• Risk Assessment: Detailed analysis of potential privacy impacts and their likelihood.
• Control Measures: Specific safeguards and security controls to protect personal information.
• Consultation Record: Documentation of stakeholder input and privacy officer review.
• Action Plan: Timeline for implementing privacy protection measures and ongoing monitoring.
• Sign-off Section: Formal approval from designated authority figures.

A Data Protection Impact Assessment differs significantly from a Data Protection Policy in both scope and purpose. While both documents address privacy concerns, they serve distinct functions in your organization's data protection framework.

• Timing and Purpose: A DPIA is a project-specific assessment conducted before new data processing activities begin, while a Data Protection Policy sets ongoing, organization-wide rules for handling personal information.
• Scope of Analysis: DPIAs focus on evaluating specific privacy risks and impacts of particular projects or changes, whereas policies establish general standards and procedures for all data handling.
• Legal Requirements: Under NZ's Privacy Act 2020, DPIAs are required for high-risk processing activities, while policies are broader governance documents that demonstrate overall compliance commitment.
• Review Cycle: DPIAs are conducted as needed for new projects or significant changes, while policies require regular reviews and updates to maintain relevance.