Phishing Policy Template for New Zealand

A phishing policy is a critical cybersecurity document that establishes comprehensive guidelines for protecting your organization against email-based threats, social engineering attacks, and fraudulent communications. This policy serves as your organization's primary defense mechanism against cybercriminals who attempt to steal sensitive information, compromise systems, or gain unauthorized access to personal data through deceptive emails and communications.

When do you need this document?

You need a phishing policy when your organization handles personal information subject to the Privacy Act 2020, operates email systems accessible by employees or contractors, or processes sensitive business data that could be targeted by cybercriminals. This policy is essential for companies with remote workers who access organizational systems from various locations, businesses that handle customer data or financial information, and organizations that rely on email communications for daily operations. You should also implement this policy if your organization uses third-party IT services, cloud-based systems, or electronic payment processing, as these create additional vulnerability points for phishing attacks.

Key legal considerations

Your phishing policy must address several critical legal obligations under New Zealand law. The Privacy Act 2020 requires organizations to implement reasonable security safeguards for personal information, making phishing prevention a legal necessity rather than just good practice. The policy should clearly define roles and responsibilities for cybersecurity, establish incident response procedures that comply with breach notification requirements, and outline training programs to ensure all personnel understand their obligations. Under the Crimes Act 1961, particularly sections 249-252, your organization could face liability if inadequate cybersecurity measures contribute to computer system crimes or unauthorized access. The policy must also consider employment obligations under the Employment Relations Act 2000, ensuring that cybersecurity responsibilities are clearly communicated to all staff members and contractors.

Legal requirements in New Zealand

New Zealand organizations must ensure their phishing policies comply with the Privacy Act 2020's requirement for reasonable security measures protecting personal information. This includes implementing technical safeguards, conducting regular security assessments, and maintaining documentation of cybersecurity measures. The Harmful Digital Communications Act 2015 may apply when phishing attacks involve deceptive communications targeting your organization or employees. Your policy should establish clear procedures for reporting suspected phishing attempts to relevant authorities, including the Computer Emergency Response Team New Zealand (CERT NZ) when appropriate. The Contract and Commercial Law Act 2017 provisions regarding electronic transactions require that your policy address security measures for electronic communications and digital signatures. Organizations must also ensure that their phishing policy aligns with any industry-specific regulations and international standards if they operate across multiple jurisdictions or handle data subject to overseas privacy laws.