When Should I Add a ‘Use of Personal Information’ Clause to my NZ Privacy Policy? 

Summarise with: ChatGPT Perplexity Microsoft Copilot

---

Table of Contents

• What Goes Into a Privacy Policy?
• When Should I Add a ‘Use of Personal Information’ Clause to My Privacy Policy?
• Using Personal Information Within Your Business
• What Should My ‘Use of Personal Information’ Clause Include?
• Key Takeaways
• Frequently Asked Questions

Your business’ privacy policy should be an informative document that tells your customers how you use their personal information. Not only does the law require that you disclose when you collect personal information, but your customers will also care that you are transparent about the procedure. The Privacy Act specifies what you need to tell your customers, and you can do so in a privacy policy. One of these standards is to tell individuals how you use this information, which you would do in a ‘Use of Personal Information’ clause. This article will: 

• explain when you should add a ‘Use of Personal Information’ clause to your privacy policy; and 
• provide some background around how the law regulates this process.

What Goes Into a Privacy Policy?

A privacy policy (or privacy statement) is a document that outlines what personal information you collect and how you collect it. You should also make sure it details:

• the purpose you collect personal information for;
• who has access to this information;
• whether a particular law authorises this collection;
• whether an individual can choose not to give you any personal information;
• the consequences of opting out of giving you personal information;
• your contact information; and
• your customers’ right to access and correct any personal information you hold about them.

It would also be a good idea to include reassurances that you secure any personal information according to its importance and sensitivity. A good privacy policy is transparent and details all points of collection. Some methods will be obvious, such as pop-ups asking for email addresses. However, others are not immediately apparent, such as the information you can gain from website cookies.

When Should I Add a ‘Use of Personal Information’ Clause to My Privacy Policy?

When you collect personal information, you need to do so with a set purpose in mind, such as collecting physical addresses for delivery. You are going to use the personal information for that purpose, which means you need to inform your customers of this fact. Therefore, if you use personal information, you need to add a ‘Use of Personal Information’ clause to your privacy policy.

For instance, you may collect cookie data of website visitors for web analytics purposes. You need to detail this in your privacy policy, telling your customers that you intend to analyse their cookie data (which can include personal information), using it to better improve your website’s services.

Using Personal Information Within Your Business

The Privacy Act mandates that when you use personal information, you can generally only do so according to the purpose you tell your customers at the time of collection. The purpose and proposed uses you outline in your privacy policy are the ones your customers expect. However, there are a few situations where you may deviate from this rule and use personal information for a new purpose. Such cases include when:

• you are using the information in a way that directly relates to your original purpose;
• you cannot identify the individual the information is about;
• the personal information is from a publicly available source;
• using the information is necessary to prevent a serious threat to the individual or society;
• doing so is necessary for complying with the law; or
• you have the permission of the relevant individual.

What Should My ‘Use of Personal Information’ Clause Include?

Prior to this clause, you should have already identified what personal information you collect. Now, you need to outline all of the ways you intend to use this information. Be as comprehensive as possible so that you do not need to double back and get customer consent for any uses you did not include. If you need to use personal data in a way that you did not already specify, you need to get your customers’ permission.

Key Takeaways

If your business collects personal information, you will use it for some purpose. You need to tell your customers this purpose and stick to it unless there is a valid reason not to.  A ‘Use of Personal Information’ clause is where you outline how you intend to use customers’ personal data. Therefore, you should include one in your privacy policy. If you would like more information or help with how your business uses personal information, contact LegalVision’s data, privacy and IT lawyers on 0800 005 570 or fill out the form on this page.

Frequently Asked Questions