Data Protection and Use

We are developing a policy to help everyone to easily understand what's appropriate, what's not, and how to do things safely when personal information has a role to play. We are calling this the Data Protection and Use Policy.

New Zealanders need confidence that their privacy is not breached, and their safety and wellbeing is not compromised when dealing with government and organisations within the social sector.

There are a wide range of laws, guidelines and codes of practice that inform how and when personal information is collected, used and shared in the social sector. They can be hard to navigate which can cause confusion about what is and isn’t appropriate with respect to using peoples’ personal information.

We ran an engagement process to find out what people think

Between May and September 2018 we met and listened to New Zealanders to find out what they think needs to be included in the Policy.

We held 83 hui and more than 1000 people participated in the engagement process, including service users (for example, youth and people who use mental health services) non-governmental organisations (NGOs) and government agencies that provide social services.

We have published the findings of the engagement in a report titled ‘What you told us'.

Findings from the engagement being used to inform the policy

The findings of the engagement on the protection and use of data have confirmed the major areas set out for the policy to address as appropriate. We’re using the findings to ensure that we develop a draft policy that addresses a range of concerns, is practical and applicable to a diverse sector.

Overview of the Data Protection and Use Policy

The Policy is being developed to address each of the topics identified during the engagement.

The scope of the policy is to:

  • Ensure those receiving social services have a better understanding about how their personal information is collected and used;
  • Clarify when personal identifiable information is needed and what types of personal information should be used for what purpose;
  • Build understanding of what protocols, structures and measures need to be in place to protect personal information;
  • Equip the social sector to work together using information to improve services and make better decisions for New Zealanders; 
  • Build understanding, trust, and confidence around the collection, storage and analysis of information.

What do we mean by a “policy”?

The Policy will be a combination of principles and guidelines. It will be supported by a ‘toolkit’ which will be developed over time, to support and enable the social sector to easily understand what‘s appropriate and how to safely work with personal information.

Further information about the Policy is included in the FAQs page.

Programme Timeline

Here are the key steps in the process to develop the Data Protection and Use Policy.

Early 2018  Design of the engagement process
May – Sep 2018  Engagement phase (Your voice, your data, your say)
Oct – Nov 2018  Collaborative policy design – sector representatives
 Nov 2018  Findings  published
Jan - Jun 2019 Refinement of draft Policy
Jul - Aug 2019 Targeted engagement – the Policy and implementation options
Sep Onwards Implementation planning
Late 2019 Data Protection and Use Policy presented to Cabinet*

 *Subject to confirmation

Frequently Asked Questions (FAQs) 

We’ve provided some FAQs on the Policy to help people understand more about the topics we are talking about. They also define some terms to help people better understand the conversation.

Read the Policy FAQs


If you have any other questions, please to email us.


Export PDF