Short answer Paste the prompt below into ChatGPT, Claude, Gemini or Copilot with your own details and you get a plain-English privacy statement for your website based on what you actually collect, with gaps flagged to check. Works on free plans. Time saved: about 1 to 2 hours on a first draft (estimate).
Why it helps
If your website has a contact form, a booking system, a newsletter sign-up or analytics, you're collecting personal information. Under the Privacy Act 2020 you need to tell people what you collect, why, who you share it with, and how they can see or correct it.
Copying another business's privacy policy doesn't work, because it describes their systems, not yours. AI can turn a simple list of what you actually collect into a short, plain statement. The Privacy Commissioner also has a free tool for this, called Priv-o-matic, so use both and compare.
The prompt
Copy it, swap the bits in [square brackets], and paste it into ChatGPT, Claude, Gemini or Copilot.
Help me write a privacy statement for my small business website in New Zealand. It should follow the Privacy Act 2020. Use plain NZ English and short headings. Cover: who we are and how to contact us about privacy, what we collect and how, why we collect it, who we share it with (including tools and services), where it's stored, how long we keep it, how people can ask to see or correct their information, and that they can complain to the Privacy Commissioner. Rules: - Only describe what I list below. Don't add things I haven't said we do. - Where something is missing, write "[check: ...]" and list it at the end. - Don't quote legal sections or claim it makes us compliant. - Under 400 words. My business: [name, what you do, town] Privacy contact: [role and email] What we collect and how: [e.g. contact form, bookings, newsletter, payments, analytics, cookies] Tools we use: [e.g. booking app, email newsletter tool, website host, analytics] Who we share it with: [e.g. nobody, our accountant, a courier]
Then keep chatting
Write a two-sentence privacy note to put under my contact form.
List the questions I should check with each of the tools I use.
Make it easier to read, like you're explaining it to a customer at the counter.
Step by step
- List everything your website collects: forms, bookings, sign-ups, payments, analytics and cookies. Check your website builder's settings if you're not sure.
- List the tools that touch that information, like your booking app, newsletter tool and web host.
- Fill in the prompt and read the draft. Fix anything that doesn't match what you actually do.
- Compare it with the statement from the Privacy Commissioner's free Priv-o-matic privacy statement tool at privacy.org.nz.
- Put it on your website, link it from your footer and forms, and update it when you add a new tool.
Worked example
Example details are made up. Your results will vary, so always read and check before you use them.
Watch out for
- It's a draft, not legal advice. Check it against the Privacy Commissioner's guidance and free generator at privacy.org.nz. If you handle health or other sensitive information, get it checked properly.
- It must match reality. If the statement says you don't share data but your booking app does, fix the statement or the setup. Check each tool's own privacy terms.
- New rule from 1 May 2026: if you collect personal information about people from someone else (not from them directly), you may need to tell them (IPP3A). See privacy.org.nz.
- Privacy: you don't need any customer details for this prompt, just a list of what you collect.
Go further
Add a short privacy line to your forms using the client intake form use case. If customers ask the same privacy questions, put the answers on your customer FAQ page.
