Privacy Act 2020 IT Checklist

Understanding the Privacy Act 2020 for IT

The Privacy Act 2020 introduced significant changes to New Zealand's privacy landscape. For IT departments and procurement teams, this means a renewed focus on data governance, security, and lifecycle management. Key principles, such as accountability, transparency, and data minimisation, have direct implications for system design, data storage solutions, and third-party vendor selection. Proactive measures are essential to mitigate risks and ensure personal information is handled appropriately.

IT Checklist for Privacy Act 2020 Compliance

This checklist provides a framework for evaluating your organisation's IT posture in relation to the Privacy Act 2020. It is not exhaustive and should be used in conjunction with legal advice and internal policy reviews.

Data Collection and Purpose

• Are IT systems configured to collect only personal information necessary for a lawful purpose?
• Are individuals informed about the purpose of data collection at the point of collection (e.g., through privacy statements on web forms)?
• Is there a clear process for reviewing and approving new data collection initiatives from an IT perspective?

Data Storage and Security

• Are personal information databases and storage solutions adequately secured against unauthorised access, loss, or damage?
• Do IT systems implement appropriate encryption for data at rest and in transit?
• Are access controls granular and regularly reviewed, ensuring only authorised personnel can access personal information?
• Is there a robust backup and recovery strategy in place for all systems holding personal information?
• Are third-party cloud providers and data centres assessed for their security practices and compliance with NZ privacy standards?

Data Use and Disclosure

• Are IT systems configured to ensure personal information is used only for the purpose for which it was collected, or a directly related purpose?
• Are there technical controls to prevent unauthorised disclosure of personal information, both internally and externally?
• Is personal information anonymised or de-identified where appropriate and technically feasible?
• Do IT systems facilitate the secure transfer of personal information when disclosure is authorised?

Individual Rights and Data Access

• Can your IT systems efficiently locate and retrieve all personal information held about an individual for access requests?
• Are there processes and technical capabilities to amend or correct personal information when requested?
• Can personal information be securely deleted or destroyed when no longer required, in accordance with retention policies?

Data Breach Management

• Does your organisation have an IT-specific data breach response plan that aligns with the Act's notification requirements?
• Are IT systems capable of detecting and logging potential data breaches?
• Is there a clear process for IT to assess the severity of a breach and its impact on personal information?

Accountability and Governance

• Are IT staff trained on their responsibilities under the Privacy Act 2020?
• Are privacy-by-design principles incorporated into the development and procurement of new IT systems and applications?
• Is there a regular audit schedule for IT systems to assess privacy compliance?