Independent Privacy Impact Assessments for New Zealand and Australian business. We map how your project handles personal information, assess it against the NZ Privacy Act 2020, and give you findings you can act on and defend.
Book a privacy conversation →Privacy problems are cheap to fix on a whiteboard and expensive to fix in production. The pattern is familiar. A new system is selected, built and configured, and only near go-live does someone ask where the personal information is actually stored, who can see it, how long it is kept, and what happens when somebody asks for it back. By then the answers are architectural, and changing them means rework.
The other common trigger is external. A client, an agency or an insurer asks for a Privacy Impact Assessment before they will proceed, and the project stops while one is produced.
A Privacy Impact Assessment, or PIA, is a structured assessment of how a project or system collects, uses, stores, discloses and disposes of personal information, measured against the information privacy principles in the NZ Privacy Act 2020. It identifies where the design creates privacy risk, rates that risk, and recommends proportionate changes while they are still cheap to make.
Done properly it is a design tool rather than a compliance artefact. The value sits in the findings you act on before build, not in the document filed afterwards.
What personal information is collected, from whom, by what means, and everywhere it then goes.
The information privacy principles, including IPP 3A and the rules on disclosure outside New Zealand, applied to the design in front of us.
Risk stated in business terms, with proportionate recommendations sized for the project rather than a wish list.
A report written to be read by a client, an agency or the Privacy Commissioner, not only by a privacy team.
We assess privacy risk and recommend. We are not lawyers and we do not give legal advice. Where a question turns on legal interpretation, whether a particular disclosure is permitted, whether a privacy notice is adequate, whether a threshold in the Act is met, we identify it clearly and recommend you put it to your legal advisers. Saying so in the report is considerably more useful to you than a confident answer we are not qualified to give.
We have no system to sell you and no platform to defend, so the findings follow the information rather than a commercial interest. That matters most when the honest answer is that a project should collect less, keep it for less time, or not proceed in its current form.
A structured assessment of how a project handles personal information, measured against the information privacy principles in the NZ Privacy Act 2020. It identifies privacy risk in the design, rates it, and recommends changes before the design is locked in.
The NZ Privacy Act 2020 does not require a PIA for every project. Public sector agencies are expected to complete them where a project has privacy implications, and private organisations increasingly need one because a client, an agency, an insurer or a partner has asked. Whether one is required in your specific circumstances is a question for your legal advisers.
The information flows, an assessment against each relevant privacy principle, rated findings, and prioritised recommendations with named owners. Plus a short executive summary, because the people who approve the project will not read the full report.
Most are measured in weeks. The main variable is how settled the design is: assessing a clear design is quick, while a design still in motion means reassessing moving parts.
No, and we would rather not have it. The assessment works from design documentation, information flows, contracts and interviews. Looking at real personal information would add privacy risk rather than reduce it.
Yes, and it is one of the more common requests now. Entering personal information into an AI tool can be a disclosure, and may send that information offshore, which brings the privacy principles squarely into play. Our secure AI adoption work covers the wider governance picture around it.
No. We assess privacy risk and recommend practical changes. Questions of legal interpretation we flag and refer to your legal advisers, and we say so in the report rather than quietly guessing.
A PIA looks forward at a project that has not gone live yet. A privacy audit looks back at what you already do, and whether it matches your obligations and your own policies. Different timing, different purpose, and often a different audience.
A no-obligation conversation about the project, the personal information involved, and what a Privacy Impact Assessment would cover.
Book a privacy conversation →