Privacy policy aligned to the 13 Information Privacy Principles (IPPs) of the Privacy Act 2020, combined with the mandatory privacy officer designation required of every "agency" — including a three-table café — under section 201, plus the IPP3A indirect-collection notice requirement taking effect 1 May 2026. Unlike Australia, there is no small-business exemption.
⚠️ This is a blank template, not legal advice: check the wording with a lawyer and adapt it to your jurisdiction and your case.
This template has no optional clauses: the text is the same for everyone.
Required fields not filled: 12. The PDF will have blank lines in their place to fill in by hand.
Click a field label in the text and type, or use the form. Empty fields become blank lines in the PDF.
PRIVACY POLICY AND PRIVACY OFFICER DESIGNATION
Effective date:
This policy explains how collects, holds, uses, and discloses personal information, in accordance with the 13 Information Privacy Principles (IPPs) of the Privacy Act 2020. Unlike some other countries, the Privacy Act 2020 applies to every business in New Zealand regardless of turnover — there is no small-business exemption.
1. PRIVACY OFFICER 1.1. Under section 201 of the Privacy Act 2020, designates a privacy officer: , contact , designated on . 1.2. The privacy officer is responsible for this business's compliance with the IPPs, handling individuals' access and correction requests, and liaising with the Office of the Privacy Commissioner (OPC).
2. WHAT WE COLLECT 2.1.
3. WHY WE COLLECT IT 3.1.
4. INDIRECT COLLECTION 4.1. 4.2. ⚠️ From 1 May 2026, IPP3A requires that where personal information is collected indirectly (e.g. booking-platform referrals, CCTV footage, social media, third-party reviews), the individual must be notified, subject to limited exceptions.
5. DISCLOSURE 5.1.
6. STORAGE AND SECURITY 6.1.
7. ACCESS AND CORRECTION 7.1. 7.2. Under IPP6 and IPP7, individuals may request access to, and correction of, their personal information held by us.
8. COOKIES AND ANALYTICS 8.1.
9. PRIVACY BREACHES 9.1. 9.2. Where a privacy breach poses a risk of serious harm, we will notify the Office of the Privacy Commissioner via NotifyUs and affected individuals as soon as practicable, as required by the Privacy Act 2020.
10. COMPLAINTS 10.1. If you are not satisfied with our response to a privacy concern, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.
This is a boilerplate template, not legal advice. New Zealand employment, privacy, consumer, food-safety, and work health & safety law combines the Employment Relations Act 2000, the Holidays Act 2003 (under active reform via the proposed Employment Leave Bill), the Privacy Act 2020, the Consumer Guarantees Act 1986, the Fair Trading Act 1986, the Food Act 2014, and the Health and Safety at Work Act 2015 — several of which are mid-reform as of mid-2026 and change on fixed dates that this template flags but does not resolve for you. Have it reviewed and adapted by a lawyer or Employment New Zealand before use, check current guidance and free official templates at employment.govt.nz (including the Employment Agreement Builder at eab.business.govt.nz), and confirm the minimum wage and any other statutory rate in force on the date of use (rates change every 1 April).
Documents that are usually drawn up in the same process.
Booking, cancellation, and no-show policy — deposits and no-show fees are lawful in New Zealand when clearly disclosed before the booking is made, and are not an unfair penalty provided the amount is…
Refund and returns policy consistent with the non-excludable guarantees of the Consumer Guarantees Act 1986 (CGA) — a "no refunds" sign or statement is itself misleading conduct under the Fair Tradin…
Health and safety risk register and incident register — every PCBU (person conducting a business or undertaking) has a primary duty under the Health and Safety at Work Act 2015 to manage risk so far…
1 of 13 fields are taken from the company, employee or counterparty record, the questionnaire can be dictated to the AI, and the finished document comes with a number, a PDF and an acknowledgement record.