How to write a 'Purpose Statement'
This tool explains the key steps involved in developing a good purpose statement:
- Writing purpose statements, that explains how to capture the 'why' in a way that helps ensure transparency and openness with service users: PDF format, HTML format
A purpose statement explains why you need to collect or use someone’s information. They’re a key building-block for a number of things:
- Explaining to service users what you’re asking them for and why.
- Making sure that the most relevant information is collected and used in the most trustworthy way.
- Making sure we collect/use only what we need, for example only collecting personal information (that does, or can, identify someone) if we really need to.
- Capturing your thinking as it develops, so that a wider range of people can contribute their ideas and suggestions, and checking the thinking.
- Record the thinking in a way that can be re-used for other tasks, such as ensuring that those who actually collect the information, know why (see the Transparency and Choice guideline).
- Making sure we apply the He Tāngata principle.
Where else does a purpose statement get used?
They information in a purpose statement is often a key thing that’s re-used in the following ways:
- Privacy statements.
- Consent forms.
- Privacy impact assessments.
- Leaflets for service users.
- Partnering Agreements and Contracts.
This guide shows how to develop a purpose statement and write it down clearly to support transparency for others.
For a deeper understanding about why it’s so important to think through ‘Purpose’ clearly, see the full Purpose Matters Guideline.
The Office of the Privacy Commissioner has a tool for building privacy statements. It’s designed for small to medium organisations. You can find it here: privacy.org.nz/further-resources/privacy-statement-generator/
A good purpose statement is based on getting 3 things clear:
It doesn’t just say what is collected, but it connects the dots so others can see why that information is needed and how it relates to improvements for He tāngata.
Purpose statements should assume that others (organisations, professionals, service users) will be interested to understand the what, why, and how.
This defines the Data or Information that you will collect, or use.
We need to collect the following information ….
Check: is all this information necessary, for this purpose? Is there a different way that needs less?
This defines the Purpose. It is what you will directly achieve, by collecting or using this information, in this particular way.
Which means that we can … decide/check/understand …
Check: is this purpose a reasonable one, that’s part of your work? Will service users see that too?
This is the Outcome. It explains the connection between achieving the purpose, and how that makes a difference to people, whānau, or communities.
So that we can improve the wellbeing of ... by …
Check: if there’s a sense of ‘maybe, it might, or possibly’, then think carefully if the purpose really works.
Why this purpose matters
- What the outcomes are meant to be – what is the effect of this on the social sector or for service users, whānau and communities?
- How those outcomes will help improve people’s wellbeing.
- Is it going to directly help individuals, their communities or people in similar situations to them? Or will it help people in some other way? The effects or outcomes can be about particular people, or it can be a “public good”.
- For example, is it helping because it:
- Makes it easier for whānau to get the help they need from a range of places?
- Helps a service provider know what training their staff need to support people?
- Means the service provider can deliver the service in a consistent and helpful way?
- Helps government make informed decisions about what kinds of services are needed?
- Means researchers can understand something to improve how we support people?
What is the purpose
- Why is this particular data or information needed?
- What actions, tasks, decisions, activities or processes is collecting or using the data or information part of? What will it enable?
- Some ways it can be helpful to outline the purpose are:
- “The questions this will answer are…”
- “The information will tell us…”
- “The data will enable…”
- “The data evidences…”
- “This information makes it possible to do X”
- Saying that data or information will be used for “research or statistical purposes” isn’t clear enough to define a purpose.
- What kinds of research that answers what questions?
- What does “statistical use” really mean?
- What is the result of “research or statistical use”?
- Does this mean it’s used once or multiple times?
- When it comes to data or information that does, or can identify someone (personal) the Privacy Act is clear that any purpose should relate to the role of the agency or organisation and its functions.
- Consider being specific about what data or information won’t be used for.
- If you’re re-using information you’ve already collected, why was it originally collected? If the two things don’t match-up, get advice: you may not be able to do what you’re planning to do.
Keep in mind that:
- “Just in case”, “could be interesting”, or “we have it so let’s use it” aren’t good for purpose statements.
- If there’s more than one purpose (even if for the same information), then define and capture them separately.
- Think about what won’t happen, and who won’t see it. Write that down. People can often be anxious due to wrong assumptions about who might see their information, or what it might be used for. Capture those limits and boundaries as you go. It can contribute significantly to people’s sense of comfort and trust. Manaakitanga.
What is needed for this purpose
- What information or data is needed – be as specific as possible:
- Is it data or information that does, or can, identify someone (personal) or that can’t and won't (non-personal or de-identified)?
- Who is it needed from - everyone or just a sample of people, services, or communities?
- Is it information that describes people’s circumstances, their experiences, their engagement or progress with a service, their home life, their wellbeing?
- What services, programmes, interventions or organisations will have this information – are they able to share it?
- Being specific doesn’t mean you have to write out a full list of every single data point or details of a methodology. But explain enough so that no one would be surprised if they did see the full list of every variable or single piece of information.
- Think critically about the information or data that you think you might need, for example:
- If ethnicity doesn’t matter – it shouldn’t be collected and if it does matter – what exactly will be collected and how will it be categorised?
- If gender will be collected what categories will be used?
- Do you really need date of birth – or will year of birth or age be enough?
- If information about “success” or “progress” in a service or programme is going to be used – who will decide what success or progress looks like and how it will be measured?
- What are the possible unintended consequences of misinterpreting or misusing this data or information? Who needs to be involved in making sense of it to avoid that?
- Keep in mind that information you think doesn’t or won’t identify someone, might possibly be able to do that if used in certain ways. Check your thinking.
- Outline any data matching or linking that needs to be done to achieve the purpose:
- What will be matched?
- What other data or information will it be matched to?
- Why is matching needed?
- What will happen with the matched data or information?
- Can you explain this to service users, so that it makes sense to them?
- When it comes to data or information that does, or can, identify someone (personal information) the Privacy Act is clear that only what is “reasonably necessary for the purpose” can be collected or used.
- Aim for minimum necessary, not maximum possible when it comes to collecting or using data or information across the social sector. If identifying information isn’t needed don’t ask for it.
Who will see it
- Who will see it:
- At the agency collecting it?
- If it will be shared with any other agency or organisation, what will they use, who will see it?
- How will they use it, or see it? Will it be anonymised or de-identified? Will they only use some of the information, or all of it? Focus on each separate purpose individually.
- Get as specific as you can:
- It may be reasonable to name people (e.g. “your case worker”)
- Use titles or job descriptions (e.g. Administrative workers will only see X so that they can …, analysts at Ministry Y).
What laws allow this
- What laws allow the information to be collected or used in this way. For example:
- When it comes to personal information the Privacy Act is likely to matter.
- Other laws, Approved Information Sharing Agreements (AISA) or agreements might come into play.
- Keep in mind that some laws apply over and above the Privacy Act.
- If it’s not clear what law allows this data or information to be collected or used for this purpose then the work shouldn't move forward.
Choices and circumstances
- Are there particular circumstances or situations for the people whose information it is that need to be taken into account and explained in the purpose statement? For example:
- If the information is culturally sensitive, then who will advise on it’s use?
- Is the information collected from people at a time of crisis? What steps need to be taken so that they can still understand what happens with their information, at a time that makes sense for them?
- Is the information about children, people who are marginalised, or people at greater risk of harm, and whose information needs greater protection?
- Did the service users provide the information directly to your organisation? Or did it come via another organisation? Do you know what they were told about use?
- Did the information come from people who self-referred to a service, or were referred by another organisation? What does that mean for information use?
- Service users should have as many choices as possible about their data and information, even if it doesn’t, or can’t identify them. Take a close look at the purpose(s), to check what choices can be offered.
- The Privacy Act states that service users should be told what information is compulsory and what is voluntary and the consequences of not providing it.
- A purpose statement should outline any specific decisions around choices for this purpose. If service users don’t have a choice then say that clearly. Keep in mind that any decision not to give choices should be thought through carefully and checked with appropriate people to make sure it’s fair, reasonable and respectful, as well as legal.
Even though there is a lot in the last few pages, the purpose statements themselves don’t have to be long and complicated. In fact, succinct is better.
There is no single way to write a purpose statement. But below are some tips and things to keep in mind:
Straight forward, direct, and understandable
- Avoid jargon (words that only mean something to specific people), labels, “short hand” words, or overly technical words.
- Describe exactly what you mean, be specific. Aim for ‘plain English’ (shorter sentences, active verbs).
- Use lists to make it easy to read things like the different types of data or information.
- Consider the audience:
- How much do they already know and what might they need to know?
- What role will they have in collecting or using the data or information?
- Would diagrams or pictures be a useful way to explain the purpose?
- How could, or might, this information get to service users, in a way that works for them?
Easy to use in a number of different situations
- Create purpose statements that can be used:
- Online, or in off-line forms.
- In partnering agreements and contracts
- In presentations and workshops.
- In face-to-face conversations.
Layered purpose statements
Some organisations use “layered” privacy statements where different versions (or layers) have different amounts of detail. This is useful on a web page where people can click into further detail.
This can work with purpose statements too. Keep in mind that the “top” layer should still cover off everything it needs to. If explanations are summarised poorly they may can be unclear or unhelpful. Don’t rely on websites as the only way of communicating. Not everyone will find this an easy way to get what they need.
Think carefully about what people will need or ask
- Imagine you’re chatting with a service user, asking them for information. Imagine they’re your mum, your partner or your teenager:
- What questions would they ask?
- What would you say to make them feel comfortable about asking, or about what’s happening with their information?
- What do you need to say to feel confident you’ve been honest, open and as complete as they want you to be?
- How will they be feeling when their information is collected? Are they scared or anxious?
- Is English a second language for them?
- Do they need to have things communicated in a certain way to make it easy for them?
Multiple purpose statements
A clear, concise, well described purpose statement should work for many audiences.
However, there may be a reason to create different versions of the purpose statement for different groups. For example technical specialists may want or need more detail about exactly what data or information is involved. Someone else may be more interested in detail around what the intended outcome is.
If you take this approach be careful to make sure everyone still knows everything they should. There is a risk that differing groups will understand or interpret the purposes in different ways and get confused, or make wrong assumptions. If different versions inadvertently contradict each other, this can lead to both privacy, and ethical issues, that can sometimes become significant problems.