Privacy Information Notice Template for New Zealand

A Privacy Information Notice is a legal requirement under New Zealand's Privacy Act 2020 that ensures organizations transparently communicate their data collection and handling practices to individuals. This document serves as your primary tool for compliance with privacy principles and helps build trust with customers, employees, and other data subjects by clearly explaining how their personal information will be managed.

When do you need this document?

You must provide a Privacy Information Notice whenever you collect personal information from individuals, whether directly through forms, surveys, or applications, or indirectly through third parties, website analytics, or CCTV systems. This applies to businesses collecting customer data, employers gathering employee information, healthcare providers handling patient records, educational institutions managing student data, and any organization conducting marketing activities or operating websites that collect user information. The notice must be provided at or before the time of collection, or as soon as practicable thereafter.

Key legal considerations

Your Privacy Information Notice must clearly identify your organization as the data controller and specify the types of personal information being collected, including sensitive information like health records or financial data. The document should detail all purposes for collection and use, ensuring these align with Privacy Principle 3 requirements for collection limitations. You must explain your data retention policies, security measures, and any automated decision-making processes. The notice should also cover your policies for sharing information with third parties, including service providers and overseas recipients, and clearly explain individuals' rights to access, correct, and complain about their personal information handling.

Legal requirements in New Zealand

Under the Privacy Act 2020, your Privacy Information Notice must comply with all 13 privacy principles, particularly Principles 2 and 3 regarding collection from individuals and collection purposes. The notice must be written in plain language that individuals can reasonably understand and be readily available when collecting information. For online collection, this means prominent placement on websites and digital platforms. If you transfer personal information overseas, you must comply with Privacy Principle 11 and may need additional safeguards. Organizations sending commercial electronic messages must also consider the Unsolicited Electronic Messages Act 2007 requirements. The Privacy Commissioner has enforcement powers including investigation authority and penalty provisions up to $10,000 for individuals and $100,000 for organizations, making compliance essential for avoiding regulatory action.