Privacy checks before automating a business process
Automation changes how quickly and widely information moves. A manual check may disappear, another service may receive data or a message may reach the wrong person at scale. Map the proposed information flow before turning the process on, so privacy decisions are built into the work.
Editorial responsibility: Nardus Oelofse, Chief Consultant.
By Chase & Marshal
Identify the information and its purpose
List the personal information the workflow collects, reads, creates and passes on. Include free-text notes, attachments and logs, where unnecessary details can be easy to overlook. Ask why each part is needed for the stated task.
Use an illustrative appointment workflow to make the exercise concrete. A reminder may need contact details and an appointment time. It may not need the full history held in the customer record. Design access around the task instead of giving the automation everything the system contains.
Check collection and notice arrangements
The Office of the Privacy Commissioner explains notification requirements for information collected directly under Principle 3 and indirectly under Principle 3A. Principle 3A took effect in May 2026 and has specified exceptions. Assess the actual collection, including information arriving from another source.
Review what people are told, when they are told and whether the explanation matches the configured workflow. A generic privacy statement may need closer examination when you add a new source, recipient or purpose. Use the current official guidance to inform that review.
Test permissions and unwanted outcomes
Check who can view or change information at each step. Test incorrect contact details, duplicate records and failed matches. Confirm that an exception reaches someone who can investigate it and that the workflow can be paused without losing control of pending work.
Consider retention and correction as part of the design. If a source record changes, establish what happens to copies and queued messages. If another provider receives information, understand its role, handling arrangements and the controls available to your organisation.
Give the process an accountable owner
Name the person responsible for the workflow and the people involved in privacy decisions. Keep a record of the information map, relevant settings, unresolved questions and approval conditions. Review the process when its purpose, integrations or information categories change.
Begin with a limited set of representative cases and inspect the results before wider use. The objective is a process staff can explain and maintain, with useful checks where errors would matter. Automation should make the intended work easier to perform while retaining visibility over the information it uses.
Questions answered
Is this only relevant when using AI?
Any automation that handles personal information deserves attention to its actual data flow, purpose and controls. A simple rule that sends a message can create a problem if it uses the wrong record or recipient.
Related
Sources
Sources supporting the factual statements in this article. Findings should be read within their stated dates, geography and scope.
- Helping Kiwi businesses succeed - Business.govt.nz. www.business.govt.nz. Publication date not supplied.
- Office of the Privacy Commissioner | Homedown arrow. www.privacy.org.nz. Publication date not supplied.
Map the information before automating
If an automation crosses customer records, email or several systems, we can help map the workflow and organise the questions needed before implementation.
