Data Protection and Use Policy

Supporting the respectful, trusted and transparent use of people's data and information

Development of the Policy

This Policy has been developed through extensive engagement with the social sector. The purpose of this engagement was to understand people's views of what is needed to establish and maintain respectful use of people's information, and to build trust and confidence between people and agencies throughout the sector, including funding agencies, NGOs and other providers, and the people who use their services.

To support and inform the engagement process, the Social Wellbeing Agency (SWA) drew upon an extensive body of existing work in this regard, including reports from the Privacy Commissioner.

In providing their insights, the people who participated in the engagement drew upon their experiences. These included working in a wide range of contexts in the social sector, in navigating a complex landscape of law, regulation and policy, and in delivering positive outcomes to the people and communities who use their services. A full description of the engagement process, and the insights provided by the sector, can be found at The Policy is based on these insights.

The Principles were created from the thoughts, ideas, experiences and viewpoints of a diverse range of people, who were clear about what they think ‘doing the right thing’ looks like. Some organisations, agencies and professionals already practice the essence of the Principles.

How this Policy will evolve

The Policy is expected to evolve over time in response to changing legislation, experiences gained through application of the Principles and Guidelines, and evolving guidance on data and information best practice. An accompanying Toolkit will provide practical resources to use when applying each Guideline. The Toolkit will also evolve over time, developed and enhanced by the sector.

Extra guidance

The following background information is not part of the formal Policy.

View all at once

Our engagement on data protection and use produced a number of findings. Through a collaborative design process with the sector, these have been used to help develop the content and structure of the Policy.

In summary, these findings include:

  • Safe and respectful use of people's information is a joint responsibility.
  • Being clear and honest about the purpose of asking for collecting and using people's information is highly valued by service users.
  • Anything done with people's data and information in the social sector must be done to help and improve wellbeing.
  • More needs to be done create a ‘two way street’ so that organisations can access and use non-personal information to improve outcomes for those they work with.
  • Empowering service users is about enabling understanding, access, choice and control.
  • People view their information as valuable parts of their personal stories and identities ‐ remember and respect that.
  • We need a common agreement on what safe and respectful use looks like.
  • People want to learn more about working with data and information.
  • We need a plan to improve practice, and to change behaviours and actions.

Published engagement findings

The findings report ‘What you told us’ was published in November 2018. We chose to present the findings report in a way that is ‘true to the voice’ of participants by incorporating well over one hundred anonymised quotes, thoughts and ideas presented by participants who contributed throughout the engagement. 

The report summarises what each of the participant groups - service users and disabled people, service providers, Māori, Pacific peoples and other national government agencies – told us. 

'What you told us' engagement findings

Engagement participants made it clear that they wanted to be involved throughout the process of developing this work. We responded to this request by forming a ‘design group’ made up of hui participants who work across a range of roles and services in the social sector.

We worked through a high-level design process with the design group, which involved workshops in various locations.  The design group helped us prioritise themes, and design what a useful Policy would consist of, what it would achieve, and the initial content.

Following the design phase, we have periodically reached out to design group members for additional feedback, through multiple cycles of development and refinement. Throughout this process we have worked to ensure that the Policy has a clear line of sight to what you told us during the engagement process.