Current as at 2026-07-13

Because everything is fine, until it is not.

Answer a few questions and get a draft website privacy policy, grounded in the Privacy Act 2020.

Every clause is written for your organisation and cited to the New Zealand Information Privacy Principles. You review it, export it, and take it to your adviser. This produces a draft, not legal advice.

Early beta. None of the big policy-generator platforms have built proper New Zealand coverage yet. PolicyPilot NZ exists to make the process simpler while that gap remains — expect rough edges, and treat every draft as a starting point.
Generate my privacy policy See how it works
Six short sections Every clause cited Nothing to install
Grounded in the Privacy Act 2020 13 Information Privacy Principles A draft in minutes Every clause cited to source

How it works

Three steps to a policy you can actually stand behind.

No legal drafting, no blank page. You answer plain questions about your business, and each answer maps to the principle it satisfies.

1

Answer six short sections

Tell us who you are, what you collect, and how you use it. Most businesses finish in under ten minutes.

2

Review the cited draft

Read a plain-English policy where every clause carries the Information Privacy Principle it is built on.

3

Export and take advice

Download the draft as Word or HTML, publish it on your site, and have your adviser confirm it fits your operation.

The generator

Build your draft privacy policy.

Answer as much as applies to your business, then generate. Every clause is cited to the principle it rests on, and anything without a clean New Zealand basis is flagged for review, not invented.

Your organisation 1 / 6

Section 1

Your organisation

This names who the policy belongs to and who a person contacts about their information.

This field is required.
This field is required.
The Privacy Act requires every agency to appoint one.

Section 2

What you collect

The categories of personal information you gather, and why — this drives the collection clauses.

Personal information you collect
Do you ever collect personal information about someone from a source other than that person (e.g. a referrer, a data provider, a public record)?

Section 3

Cookies and tracking

These decide whether your policy needs a cookies and analytics clause.

Does your site use cookies?
Do you use analytics (e.g. Google Analytics)?

Section 4

Use and disclosure

Who your information is shared with — and whether it leaves New Zealand — shapes the disclosure clauses.

Do you share personal information with third parties (suppliers, contractors, partners)?
Do you use overseas or cloud providers that hold personal information (hosting, email, CRM, AI tools)?
Do you send personal information to AI tools or vendors?

Section 5

Holding and access

How long you keep information and how people reach it.

Do you assign customers a unique identifier (e.g. a customer/account number)?

Section 6

Higher-risk practices

Flag anything sensitive so the draft flags it for review rather than guessing. Leave these off if they do not apply.

Do you make automated decisions that significantly affect people (e.g. automated credit / eligibility decisions)?
Do you collect health information or information about children?
Your draftWaiting for answers

Your cited draft policy will appear here. Fill in the sections on the left, then generate it. Every clause will show the Information Privacy Principle it rests on.

Privacy Policy

Set a reminder to revisit this policy optional

Law changes. Pick a date and we'll build a calendar reminder to check whether this draft still matches the Privacy Act 2020 — generated in your browser, nothing is sent to us.

What is covered

Six sections, mapped to the principles they satisfy.

The generator walks the same ground the Privacy Act expects a policy to cover, so nothing important is left out.

Your organisation

Who the policy belongs to, and the privacy officer a person can contact.

Privacy officer · s201

What you collect

The categories of personal information you gather, and why you gather them.

IPP 1 to IPP 4

Cookies and tracking

Whether you use cookies or analytics, and what that means for visitors.

IPP 3 · IPP 4

Use and disclosure

How information is used, who it is shared with, and cross-border transfers.

IPP 10 to IPP 12

Holding and access

How you store information, how long you keep it, and how people access it.

IPP 5 to IPP 9

Higher-risk practices

Automated decisions, health data, and children's information are flagged for review.

Codes and IPP 13

Grounded and cited

A draft you can trace back to the law.

Most generators hand you generic text. PolicyPilot writes to the New Zealand Privacy Act 2020 and shows the principle behind every clause, so your adviser can check the reasoning, not just the words.

Written to the 13 Information Privacy Principles

The framework every NZ agency is measured against under the Act.

Every clause carries its citation

You see exactly which principle each sentence is built on.

Dated so you know it is current

Each draft is stamped with the date the wording was current, and flags when the law behind it moves.

Sample clause with citation

You can ask us at any time to see the personal information we hold about you, and to correct anything that is wrong. We will respond as soon as reasonably practicable and, in any case, within 20 working days.

Privacy Act 2020 · IPP 6 (Access) · IPP 7 (Correction)

Good to know

Questions people ask first.

Read these before you generate, so you know what the draft is and is not.

Is this legal advice?
No. PolicyPilot produces a draft to help you start. It is not legal advice and does not create a lawyer relationship. Have the draft reviewed by a qualified adviser before you publish or rely on it. See the full disclaimer.
Which law does it use?
The New Zealand Privacy Act 2020 and its 13 Information Privacy Principles, plus the relevant codes for health and other sensitive information. Every clause is cited to the principle it rests on.
Do I need a privacy officer?
Yes. Under the Act every agency must have a privacy officer who handles requests and complaints. It can be a named person or a role, such as your operations manager. Your draft names them in section one.
What about cookies and analytics?
If you turn on cookies or analytics, the generator adds a matching clause that explains what you track and why, so your policy reflects what your site actually does.
What happens to my answers?
The draft is assembled in your browser from what you type. Download the result as Word or HTML and keep it wherever suits you. The same applies to the optional calendar reminder — it's built in your browser too, and nothing is sent to us. Treat any policy you publish as your own document to maintain.
Why does this say "beta"?
This is an early build. New Zealand isn't covered by the large US and Australian policy-generator platforms, so we built a smaller tool to close that gap. It covers a website privacy policy today; expect changes and new coverage as it matures.

Get your draft privacy policy in the next ten minutes.

Answer six short sections, read a policy written for your business with every clause cited, then take it to your adviser.

Generate my privacy policy

Beta · Not legal advice · Current as at 2026-07-13