Introductory Workshop

This is an introductory workshop that takes an hour, to an hour-and-a-half to deliver, depending on the audience.

It comes in 4 parts: agenda, facilitator notes, presentation (which includes some 'quiz' questions), and frequently asked questions (FAQs).

Please contact us if you'd like assistance from SWA in presenting this material to your teams, to get your started.


This is the outline agenda for the introductory workshop, with estimated timings.

1. Welcome and introductions [10 minutes]

2. What we will cover today [5 minutes]

3. Overview – why DPUP? [10 minutes]

4. The journey – timeline, engagement and policy development [10 minutes]

5. The Policy detail – structure, Principles and Guidelines [20 minutes]

6. The DPUP Adoption Toolkit [5 minutes]

7. What it means for your agency [5 minutes]

8. Quiz [10 minutes]

Work through the first 6 questions of the Online Learning Module.

9. Questions, where to go for more information and close [15 minutes]

An Introductory Workshop - the Data Protection & Use Policy

This workshop can be run face to face, or remotely with tools such as zoom. It takes between 1 - 1 ½ hours

Assumption: It’s useful if participants have viewed the introductory video ahead of the workshop. This 3.5 minute video is a compact summary of many of the ideas within the Policy, and also summarises the background to how the Policy was developed.

Item 1 – Welcome and Introductions

Get people to introduce themselves, where they’re from, what they do, and what they know so far about the Data Protection and Use Policy (DPUP).

Item 2 - What we will cover today

Facilitator goes through the Agenda at a high-level, which is to:

  • Talk about the “why”
  • Touch on the background behind DPUP and its creation
  • Look at what it means for this organisation
  • Go through the Policy detail and adoption approach
  • Finish with a short quiz, followed by time for questions.

Outline the workshop approach:

  • Goal is to introduce participants to the Policy and its relevance to them but not designed to be an in-depth or practical application workshop (but it will talk about where to go for this)
  • Intended to be Interactive – questions can be asked along the way verbally or by Chat Function (if functionality available through zoom or similar)
  • Advise whether any notes, photos, screenshots or recordings will be taken and if so, who will see or use them, and if they do not wish to be in them how to let the facilitator know.

Item 3 – Overview – Why DPUP?

Check whether they have watched the video and if not and there is time, play the video then go through bullet points below.

  • The Policy was developed by the social sector, for the social sector for government as well as non-government organisations
  • It’s relevant whenever we collect or use any kind of data or information from, or about, service users
  • Recommendations go beyond the law, and are clear when they do so, and why
  • It’s a guide for doing this in the most respectful, transparent and trustworthy way we can and in a way that makes sense in the context you’re operating within
  • It focuses more on relationships, values and behaviours and less about prescriptive rules
  • This workshop will explore these points in more detail.

Some key points to note:

  • The Policy doesn’t suggest or advise anything that contradicts the Privacy Act, but does suggest things we should do beyond the Privacy Act to be as transparent, respectful and trustworthy as possible
  • The Policy isn’t just for “data people” - information or data from, or about, service users can be used by all sorts of people in all sorts of roles, from making a referral to another service, to contract reporting or working on a new programme or policy.

Thinking about the Power of Data

Facilitator asks attendees to think about a time either professionally or personally when you have been asked for your information and felt uncomfortable about this.  Can you remember if you were provided with the ‘why’ it was needed and what would be done with it?  Ask a couple of people to share.

Data and information can be powerful because it can:

  • determine if someone receives a service or not
  • help shape government policy and funding
  • inform research into what the circumstances are for service users and communities, i.e. their needs, resilience, experiences
  • influence the creation of new services or programmes
  • tell a very sensitive, personal and emotional story of someone, or a groups experience.

When we talk about data and information – think inclusively.  Data can be numbers, stories, experiences and can be from or about the people we serve.

As with any power, if data and information are misused, misunderstood or not cared for, it has the potential to create harmful consequences for the people it is about. Because data can be powerful, we have a responsibility to be responsible, respectful, and transparent.

It all starts with “why”

Why should you learn about DPUP?

  • Because the social sector is about people (He tāngata)
  • Because data and information is powerful.

The Policy will help you:

  • use data and information in the most respectful, transparent and trustworthy way
  • use it to grow the knowledge of the sector about how best to support New Zealanders wellbeing
  • build trust with service users in how you care for their information.

Item 4 - The journey of developing the Policy – timeline, engagement and policy development

The Journey

It’s important to understand how the Policy came about because that had a big influence on what it finally looked like. 

Before DPUP was developed, there was some guidance and law around the collection and use of people’s data and information that had relevance to the social sector. For example: the Privacy Act, the Health and Disability Code.

During the development of the Policy further things came into effect like:

  • the Oranga Tamariki Information Sharing requirements
  • the Family Violence information sharing guidance
  • the Algorithm Charter for Aotearoa NZ

So why and how is the Policy relevant? Why did the social sector need it?

In 2016, MSD asked NGOs to provide individual client level data (ICLD) about their clients as a general condition of contracting with them.  ICLD (Individual Client Level Data) is information that identifies who people are.

There were lots of reasons this was a concern for many people for example:

  • it wasn’t clear why the information was needed
  • it wasn’t clear how the information would be used once it was given to MSD
  • it didn’t help create a culture of respect and care
  • people might be too scared to go to or use services if their name and details were shared with MSD – potentially putting people at risk.

In 2017 the Office of the Privacy Commissioner (OPC) completed an inquiry following complaints about the request.

The OPC inquiry found the proposal was not justified or proportionate and there was:

  • no clear and defined purpose for ICLD
  • not enough consideration of privacy risks
  • not enough consideration of concerns raised.

Following the OPC findings, the Government asked for a discussion on the use of service user data and information in the social sector.  This was led by the Social Wellbeing Agency.

While general guidance is provided by the Privacy Act, there are many aspects of the wider social sector that make it less easy for everyone to understand what’s reasonable, and what’s not, when we’re dealing with people’s information.

Key points to note:

  • (No conflict with law) DPUP was developed to work alongside and not in conflict of the various laws, guidelines, etc
  • (Goes beyond the law in places) DPUP has been carefully mapped against the Privacy Act and doesn’t contradict it
  • In places it advises actions and behaviours that go beyond what the law requires
  • This is based on the collective ideas of the sector about what it looks like to be a respectful, transparent, and trusted organisation in relation to people’s information
  • (Is about both personal and non-personal info) For example, DPUP isn’t only about personal information, but has advice about non-personal information: people were clear that even when information can’t identify them, it can still be ‘personal’ to them and the communities they are a part of.

In November 2019, Cabinet endorsed the Policy and named five foundational agencies to lead out the implementation.

  • Ministry of Social Development
  • Oranga Tamariki
  • Ministry of Education
  • Ministry of Health
  • Social Wellbeing Agency

Engagement: Your voice, your data, your say

  • During 2018, the Social Wellbeing Agency asked people for their thoughts about the investing for social wellbeing approach and what was reasonable (or not) when using people’s information. This was the ‘Your voice, your data, your say’ engagement.
  • Over a 1000 people attended the workshops, with 800 online submissions, and almost 200 service users interviews (done through trusted brokers)
  • There were dedicated engagement streams for Māori, Pacific Peoples and disabled people.

The core themes were about inclusion and transparency, a significantly greater focus on the ‘why’, and clarity about how using people’s information actually leads to better outcomes for them, their whānau, and communities. You can see the full findings here.

From voices to policy

  • The findings of the ‘Your voice, your data, your say’ engagement on social wellbeing and the protection and use of data were instrumental in the development of the Policy and the toolkit
  • This work was developed by the sector for the sector, through the work of the Design Reference Group, Ministerial Working Group and those who participated in the original engagement.
  • Cabinet endorsement of the Policy in November 2019 enabled a green light for the sector to start using it, led by the five Foundational Agencies.
  • The Policy was made publicly available in January 2020 and work began on the toolkit.

Item 5 – the Policy in Detail

At this point, the facilitator talks through the Policy in detail:

Overview of the content

  • This Policy describes values and behaviours that, when applied across the sector, will build trust and help to ensure that data practices are focused on the wellbeing of people and communities.
  • These values and behaviours are represented as five Principlesthat have people and their wellbeing at the centre.
  • The Policy then provides good practice guidance on how to uphold these Principles in key areas through four guidelines which help organisations to understand how to apply the Policy.

The Five Principles

  • The principles are at the heart of the Policy and are about values and behaviours
  • No law, policy or guideline can give step by step instructions for what to do in every situation that will occur
  • So, the principles are there to guide us, to act as a compass that shows us the direction we should head in, even if we don’t have the detailed map
  • They capture the overall beliefs of those who were involved in developing them around how data and information in the social sector should be treated and how those the information is about should be respected.

He Tāngata - focus on improving people’s lives – individuals, children and young people, whānau, iwi, and communities.

(include further detail on each principle if there is time).

Manaakitanga - respect and uphold the mana and dignity of the individuals, whānau, communities or groups who share their data and information.

Mana whakahaere - empower people by giving them choice and enabling their access, to, and use of, their data and information.

Kaitiakitanga – act as a Kaitiaki (a steward) in a way that is understood and trusted by New Zealanders.

Mahitahitanga - work as equals to create and share valuable knowledge.

The Four Guidelines

  • There is no one way to use the Policy
  • Organisations can apply it in the most sensible way for their work, the kind of data or information they collect or use and the circumstances of the service users it’s about
  • The guidelines help us to do that.

Purpose Matters

(play the Purpose Matters guideline video then go back to the slide pack and bring up the Purpose Matters key points and go through the following bullet points)

  • This Guideline is the most important of the Policy’s and should be used when a social sector agency is deciding whether to collect or use information that is, or was, about people who use social services for specific reasons
  • Clarity of purpose is vital to determining whether, in a given context, an agency needs to collect personal information and, if so, how much
  • It is also vital to determining whether the uses of that information are lawful and appropriate (so the word ‘appropriate’ signals that in places the guidelines go beyond the law), and
  • It can also determine whether a proposed sharing of someone's personal information with another agency is lawful and appropriate
  • Note, the word ‘appropriate’ signals the guidelines often go beyond what is required under law to form good practice
  • For example, if you don’t know why you hold information (the original purpose behind its collection), then you actually don’t know if, or how, you can re-use it
  • There’s a duty to ensure that you only re-use information in way that’s directly consistent with its original purposes of collection and that if you do re-use it, it’s the right kind of information for that intended use (right can mean accurate, appropriate, relevant, meaningful, etc).

Transparency & Choice

(play the Transparency & Choice guideline video then go back to the slide pack and bring up the Purpose Matters key points and go through the following bullet points.)

  • People who use social services want a good understanding of why their information is needed
  • When they're unclear about it, this can cause anxiety, especially if their current situation is already a difficult one
  • Help them understand why it’s being collected, how that might help them or people in similar circumstances, and what rights they have to access and request changes – and provide them with choices whenever possible
  • This Guideline uses the language of 'choice' rather than 'consent'
  • 'Consent' is given when a person voluntarily agrees to something based on a good understanding of the consequences
  • The language of 'consent' is often used in the sector, but without common agreement about what it means (it can have specific definitions in fields such as medicine, research and law) and often in circumstances where people who want to access a social service won't receive the help they need if they don't provide the information requested
  • For this reason, this Policy uses a plainer word – 'choice' – and focuses (in part) on the processes that help give people choices and enable them to act on those choices
  • The context of the individual is important in ensuring understanding and choice - For example, age, cultural, language and literacy must be considered, and any other circumstance of the individual that is relevant to respecting mana and enabling understanding of their choices
  • Māori providers and other Māori/iwi groups want te ao Māori considered when Māori communities are a key focus
  • Pacific peoples are looking for clear and simple explanations for people about why their personal information is being collected and how it will be used, and greater accountability to families and communities on how their data is used
  • Disabled people also highlight the need for clear information about what information is being collected, for what purpose and a greater understanding of people’s situations when asking for identification information (e.g. some disabled people do not have a driver’s licence)
  • This Guideline helps agencies facilitate service users' understanding of and, where feasible, having choices about, when and how their information is collected and used

Access to Information

(play the Access to Information guideline video then go back to the slide pack and bring up the Purpose Matters key points and go through the following bullet points.)

  • People who use social services may not understand what rights they have to see the personal information that has been collected about them or is about them, to ask for that information to be corrected, or to express a preference as to how they'd like to access their information - understanding these rights is important
  • People sometimes assume that government agencies can share, access and exchange information about them without constraint
  • If people are unsure about what is recorded about them, or whether it is accurate or up-to-date, that can affect their trust or confidence in how it's used
  • That uncertainty may deter them from providing the information in the first place, or from opting to receive a service they need
  • Conversely, the more proactive an agency is and the easier it makes the process, the more empowered service users will be
  • Their confidence that correct information will be used for the purpose for which it was collected will also be greater
  • This guideline recommends a proactive and pragmatic approach to ensuring that people understand and can exercise the options they have to access their information, request corrections to it, or in some cases change it themselves.

Sharing Value

(play the Sharing Value guideline video then go back to the slide pack and bring up the Purpose Matters key points and go through the following bullet points.)

  • It is important to develop and share the value of information and insights among those involved in the delivery of services in an inclusive, useful, respectful and valuable way
  • A collaborative approach involves exploring the objectives of information collection and analysis (the desired insights) before information is collected or before analytical activities are carried out, and what insights will be most helpful to people and agencies working on related outcomes
  • In this Guideline, the term insightsmeans non-personal information, including data and data sets, analysis, qualitative or quantitative information, statistics, research, reports or studies, that may support improved decision making.
  • Non-personal information is information that does not identify individual people
  • The term sensitive informationis used to describe information that could be misunderstood or misused, resulting in harm or embarrassment to a group or community.
  • Service providers are often required to share information they collect with other agencies for the purposes of accountability, research and analysis, and planning
  • Many people (decision-makers, government, NGOs, communities, and service users) are likely to benefit from the sharing of insights derived from information collected from or about people who use social services
  • Such insights are valuable for supporting robust decision-making and better delivery of services that support positive outcomes
  • Service providers and service users want to be involved at the beginning of the process of information collection and throughout the process of developing insights based on that information, so that they can contribute their perspectives, expertise and suggestions, and have opportunities to understand, access, and apply those insights
  • The recommended actions in this Guideline are not only about the development and sharing of insights from new data, but also apply to insights developed from existing collections of data
  • The actions recommended in this Guideline are not required by law but are common to many respected codes of practice.

Facilitator finishes this section to invite people to share – what do you do, or will you do going forward, that aligns with any of these guidelines?

Item 6 – The DPUP Adoption Toolkit

  • The Policy is supported by an online toolkit of resources and information about how it can be used in day to day work.
  • The toolkit is split into three sections:
    • LEARN: which are resources that help you gain an understanding of the Policy in a way that makes the most sense for you
    • PLAN: which helps people plan for the use of the Policy in their organisations
    • USE: which contains guidance on things to think about in the context of specific tasks, jobs, or roles.
  • The Toolkit has videos, checklists, summaries of important information for people working in different roles, workshop material, case studies and examples
  • The toolkit has information for the whole sector - from frontline workers to data scientists.

Different tools can be used at different stages in a process or service, such as developing your work programme, to policy or service design or research and evaluation, through to service delivery.

Item 7 - What will this mean for your agency/organisation?

Facilitator invites people to discuss in groups what the Policy might mean for the organisation as a whole.

Item 8 - Quiz

Take attendees through the first 6 questions of the Online Learning Module.

Item 9 - Question Time

Facilitator to answer any questions people may have, if necessary by taking a record of them and following up after the workshop.