Before you start

It’s helpful to read:

• Learn about PMAF
• Privacy maturity self-assessment process.

To complete your agency’s self-assessment, download and use the 2 forms.

PMAF self-assessment forms

1. Strategy and planning

Formulate a privacy strategy, a roadmap to bring it to life and a work programme to achieve it.

Guidance note

An agency’s privacy strategy, privacy roadmap and privacy work programme should be short, functional, living documents that are appropriate to the agency’s context and the amount and type of personal information they collect and use.

Privacy strategy

The privacy strategy sets coherent goals for where the agency wishes to get to with its privacy practices.

These goals will work well if they are coupled with objectives that are targeted and make sense in the context of the agency’s overall privacy stance and risk profile rather than being generic or overly broad.

A privacy strategy should:

• be aligned with the agency’s organisational strategy
• ensure compliance with all applicable laws (including, at a minimum, the Privacy Act)
• state privacy goals to promote a privacy culture and improve privacy practices within the agency
• be owned by a member of the senior leadership team
• state a time horizon, for example, a 2-year plan
• identify key stakeholders.

Privacy roadmap

If the strategy is an expression of the goals, then the roadmap describes the privacy objectives, how to travel between the current state and the future state, and the stakeholders who are expected to understand and support the roadmap.

A privacy roadmap should include the key areas of activity to be undertaken to achieve the strategy’s future state and:

• the accountabilities and resourcing to deliver them
• their dependencies
• their timing and duration.

Privacy work programme

An agency’s privacy work programme describes in simple terms how the objectives and activities will be achieved. A privacy work programme should describe:

• the details of the activities described in the roadmap
• a schedule of activities
• roles and responsibilities
• how progress will be monitored.

Criteria 1: Planning

Informal

Privacy planning is ad hoc or reactive to specific events and incidents.

Foundational

Privacy planning is seen as the domain of the privacy officer or team with little or no connection to the rest of the organisation.

Managed

Privacy planning:

• includes all areas of the agency
• comprehensively addresses the collection, use, storage and security of personal information, and
• is flexible to accommodate changes either in the wider business environment or as the result of assurance activity.

Criteria 2: Planning documents

Informal

The agency does not have privacy planning documents (for example, strategy, roadmap and work programme).

Foundational

The agency has privacy planning documents (for example, strategy, roadmap and work programme) that are reviewed regularly.

Managed

Privacy planning documents (for example, a strategy, roadmap and work programme) are:

• easy to understand
• communicated to those with relevant responsibilities, and
• reviewed regularly to ensure that they remain relevant and aligned with the agency’s organisational and system context (nature, scale and risk).

Criteria 3: Reporting

Informal

Reporting is ad hoc and is about specific events and incidents.

Foundational

Progress towards their privacy strategy, roadmap and work programme is reported to senior leadership and relevant governance bodies on an initiative basis.

Managed

Progress towards their privacy strategy, roadmap and work programme is tracked and reported regularly to senior leadership and relevant governance bodies.

2. Competent practice

Have policies to equip managers and staff to play their part in achieving the core expectations.

Guidance note

People can work with personal information with greater confidence if they know what to do, when to do it and who to contact for support and advice.

Project teams, policy teams, service designers and others can use privacy policies and related documents to help them think about their activities and tasks that involve personal information in the context of the work carried out by those various teams.

Privacy policies and related documents also need to include and extend to contractors, partners and suppliers who may be involved in working with personal information. Their needs and requirements may be different than those of internal staff.

Anyone who is expected to contribute towards good privacy practices should also be confident that, having understood the expectation, they know what to do by being able to access practical, documented descriptions of what actions they need to take.

The Data Protection and Use Policy (DPUP) has guidance to help agencies when drafting policies and related documents.

Use DPUP in your work

Procurement contracts can include privacy as a condition, for instance sending information to be used overseas requires special model contractual clauses.

Office of the Privacy Commissioner — Sending information overseas

Criteria 1: Policies

Informal

Privacy policies and related documents are insufficient to meet the agency’s privacy needs, are communicated in an ad hoc or reactive basis and are not regularly reviewed.

Foundational

Privacy policies and related documents meet the agency’s privacy needs.

They are used by individual initiatives or within a subset of core business processes (such as procurement, policy or service design, frontline operations and management, analysis and research) but are not explicitly aligned to agency needs.

Managed

Privacy policies and related documents are easy to understand, communicated and accessible throughout the agency, and reviewed regularly to ensure that they remain relevant and aligned with the agency’s needs.

Criteria 2: Procurement contracts

Informal

The inclusion of privacy policies in procurement contracts is ad hoc or reactive.

Foundational

The agency’s procurement contracts sometimes include terms and conditions relating to privacy policies and practices, but this happens at the individual initiative level and is not a standard practice.

Managed

The agency’s procurement contracts include standard terms and conditions relating to privacy, and privacy policies and related documents include advice on external suppliers and personal information.