UPDATED 12.45pm A major overhaul is being recommended for the way police carry out their security vetting work.

It follows an independent review of their current processes carried out by the Privacy Commissioner and the Independent Police Conduct Authority.

It has found flaws with current procedures, saying there's no overarching policy for staff to follow and the legal basis for some decisions being made are uncertain.

The review is recommending the Government look at developing a formal statutory framework for the security vetting process.

Privacy Commissioner John Edwards said police are having to make tough choices about releasing information that's in a grey area, and that's leaving them exposed.

"They either sit on information and say 'well we're not going to release that and find that the person goes on to present a risk, or they release information that they haven't verified."

Edwards said employers do sometimes have the right to suppressed information, but there needs to be crystal clear guidelines.

"For example, where a suppression order is granted for the benefit of the accused - if that information is then taken into account for a vet, you've in effect got police overriding the express decision of a court."

Police have responded by saying they're obligated to strike a balance between protecting the vulnerable, and protecting privacy.

They say a more comprehensive system is being developed.

They've also boosted the number of staff dealing with applications - but say more changes are needed to make the system better.

Police Minister Judith Collins has agreed to get that work started.

She thinks the law will have to be changed to give police both more protection around what they can reveal, but also more guidance.