What is inside.
12 sectionsFor small and medium New Zealand businesses that want a practical, ethical framework for AI and data use, without paying for a bespoke policy from scratch. It is a starting point you customise to your culture, values, and AI goals, then have a legal professional review.
Purpose & scope
Statement of intent, your specific AI goals, a data inventory, who the policy applies to, and clear accountability for data and AI governance.
Data governance
Collection, use, storage and security, data minimisation, quality, data subject rights, mapping, retention, and disposal.
Artificial intelligence
Responsible AI, fair and unbiased development, transparency and explainability, human oversight, risk assessment, and ongoing auditing.
Legal & regulatory compliance
Privacy Act 2020, the Unsolicited Electronic Messages Act 2007, the Algorithm Charter, and where the GDPR and CCPA reach NZ businesses.
Training & awareness
Annual training on data privacy and AI ethics, employee accountability, and records of training activity.
Enforcement & monitoring
Assigned responsibility, audit procedures, non-compliance consequences, and version control.
Reporting concerns
A clear reporting process, designated contact, confidentiality, whistleblower protection, and anonymous reporting.
Data breach response plan
Incident identification, immediate actions, containment, assessment, notification to the OPC and CERT NZ, recovery, and post-breach analysis.
Third-party data sharing
Vendor selection criteria, ongoing monitoring, audit rights, incident reporting, and termination conditions.
AI explainability
Understandable AI, decision-making transparency, building trust, user feedback, and continuous improvement.
Emerging technologies
Considerations for blockchain, edge computing, and synthetic data, with privacy built in.
Policy review & update
Review cadence, the stakeholders to involve, and a clear approval process.
This template is a general resource offered as-is. It is not a substitute for tailored legal advice. We recommend a qualified legal professional review and adapt it for your business.
Need help implementing
your AI policy?
We help NZ businesses develop, customise, and roll out an AI and data governance framework that fits how you actually work.
