Policy management software for New Zealand organisations

Strengthened privacy obligations and mandatory breach notification. New Zealand's Privacy Act 2020 replaced the 1993 Act with a significantly updated framework, aligning closely with international standards including the GDPR. It places clear obligations on how organisations collect, use, store, and share personal information.

• All agencies must have clear, documented, and current privacy policies that reflect actual practice
• Mandatory data breach notification - notify the Privacy Commissioner and affected individuals of serious harm breaches
• Privacy policies must be communicated to relevant staff with evidence of that communication
• The Office of the Privacy Commissioner has broad investigation and enforcement powers, including compliance notices and prosecution referrals

Primary duty of care and officer due diligence obligations. The HSWA is one of the most significant pieces of workplace legislation in New Zealand's recent history, placing strong obligations on PCBUs, officers, and workers to actively manage health and safety.

• Every PCBU has a primary duty to ensure worker health and safety - requiring documented, current, and communicated policies
• Officers have a personal due diligence duty - including ensuring appropriate information management practices
• Workers must be informed of, trained on, and acknowledge relevant WHS policies
• WorkSafe NZ expects policies to be actively implemented, reviewed, and enforced - not just documented
• Non-compliance: infringement notices, significant fines, or prosecution

Good faith obligations and employment policy documentation. New Zealand's employment relations framework creates substantial obligations for employers to document, communicate, and consistently apply employment policies.

• Employers must maintain up-to-date policies on disciplinary procedures, leave entitlements, and workplace expectations
• The duty of good faith requires employers to keep employees informed of policies that affect them
• Employers must retain evidence of employment documentation and policy acknowledgements
• The Employment Relations Authority can scrutinise whether employers met documentation and communication obligations during disputes

Strengthened whistleblower protections and accessible disclosure procedures. New Zealand's Protected Disclosures Act 2022 significantly strengthened protections for employees and others who report serious wrongdoing.

• Public sector organisations must have accessible, documented internal procedures for protected disclosures
• Best practice for all significant employers - clear whistleblowing policies with how to disclose, what protections apply, and how the organisation will respond
• Whistleblowing procedures must be effectively communicated to all staff
• Retaliation against whistleblowers is unlawful - organisations must evidence preventive measures

Governance and compliance obligations for financial services organisations. For financial service providers, fund managers, insurers, and other regulated entities, the FMCA and FMA guidance create specific governance, disclosure, and compliance management obligations.

• Licensed entities must have compliance frameworks, documented internal policies, and systems demonstrating ongoing compliance
• The FMA expects compliance policies to be current, distributed, and actively adhered to
• Directors and senior managers have personal accountability for compliance governance
• The FMA may review compliance documentation at short notice - requiring immediately producible policy records