Data Protection and Use Policy

Supporting the respectful, trusted and transparent use of people's data and information

Introductory video

This video was developed for an education sector hui in March 2020. It provides a short overview of the Data Protection and Use Policy, and while it includes some education specific examples, it provides a helpful introduction to the policy for anybody wanting to know more.


Transcript of intro video filmed for Ministry of Education sector engagement hui, March 2020.

What is the Data Protection and Use Policy?

This work’s ultimately about trust, it’s about respectful and transparent use of people’s information.

When we talk about people’s information, we mean both personal information, and non-personal information.

Personal information includes things like names and addresses but even when we remove those - it might be summaries, or it might be anonymous data - it can still be an important part of people’s lives. It can reflect their experiences, it can describe their communities, people can still see that as a treasured part of them. Some people think of it as taonga.

What does the Policy say?

So what does [the Policy] actually consist of?

The Policy contains five principles and four guidelines.


The principles talk about values and behaviours, the things that people said to us everyone expects when they are working with people who are either collecting or using their information. Those principles are He tāngata, Manaakitanga, Mana whakahaere, Kaitiakitanga, Mahitahitanga.

The principles ask us to put people back in the middle of our thinking, to respect their humanity when we are working with them and talking to them about their information. To listen to and respect their choices when we’re thinking about their information. To work together effectively for their wellbeing and their whanau and their communities. To make sure that the insights we might derive from people’s information are readily available to many organisations who have a good reason to use it for the people that they work with.


The guidelines are a different thing, they are the four topics that you asked us to provide better guidance on.

The first one is about purpose - being clear about why we might collect or use people’s information.

The second one is about transparency and choice - communicating well with people and offering them reasonable choices.

The third one is about making it easy for people to access their information, and
The fourth one is about sharing the insights – making it easy for organisations to share the value of the information in the service of their own communities.

Where did the Policy come from?

The social sector is a really diverse place. It’s really hard sometimes to know what is reasonable and what isn’t reasonable, so Cabinet asked us to go out and talk to the sector [Agencies and NGOs delivering welfare, housing, health, education, child wellbeing, justice and disability support services] and ask them that question - ‘What’s reasonable, and what’s not?’ - so that we all ended up with a set of guidance that we share together.

To work through that question, we went around NZ talking to the wider sector. There were 83 hui all over NZ, talking to all the parts of the sector, including services users, and we asked them that question, ‘what’s reasonable, and what’s not?’ and we captured their thoughts and worked through the design process with them. The output of all that work is this Policy – the five principles and four guidelines.

Is the Policy mandatory?

The Policy isn’t mandatory. It’s not new rules. It’s not a compliance exercise. It’s good practice guidance. It’s what the sector said, represented, reasonable and not reasonable, and it provides good practical guidance on how to work through those steps to come up with better results for when we’re thinking about people’s information.
It’s there to help and it’s our Policy, it’s not mine and it’s not yours, it’s ours and we’ll do this work together.

Will there be support?

When Cabinet approved this work, they asked us to stick around to help make it easy for people to implement it and we’re here to help.

The Policy invites people to apply it in a way that makes sense to them in their context. How we implement the Policy in a kura on the East Coast is obviously going to be different to how we think about the Policy in a chain of early childhood centres in Southland. There is no one answer and we’re here to help run workshops, we’re here to help pick up the content, we’re here to build a toolkit that makes it easy for you to work with the policy in a way that makes sense to you.

What now?

So what now?

Well the first thing to do is to start picking up pieces of the Policy and applying them to situations and experiences that you’ve come across yourself in the Education sector.
How do the Principles help you think things through? How do the Guidelines help you think things through? And what help might the Toolkit provide? Or over the months ahead, what could we put in the Toolkit that makes it easier for the kura on the East Coast, that makes it easier for Early Childhood centres in Southland.

How might that work? What would you like to see in there?

Find out more and let us know your thoughts.

You can find out more about the Policy on the website, and you can sign up to the newsletter to keep in touch.