Data Protection and Use

To provide clear guidance for how personal information can and can't be used in the social sector.

New Zealanders need confidence that their privacy is not breached, and their safety and wellbeing is not compromised when dealing with government and organisations within the social sector. 

There are a wide range of laws, guidelines and codes of practice that inform how and when personal information is collected, used and shared in the social sector. They can be hard to navigate which can cause confusion about what is and isn’t appropriate with respect to using peoples’ personal information.

We are developing a policy to help everyone to easily understand what's appropriate, what's not, and how to do things safely when personal information has a role to play. We are calling this the Data Protection and Use Policy.

In 2018, we ran an engagement process to find out what people think needs to be included in the Policy. We published the findings from this engagement in a report titled ‘What you told us’.

Findings from the engagement being used to inform the policy

The findings of the engagement on the protection and use of data have confirmed the major areas set out for the policy to address as appropriate. We’re using the findings to ensure that we develop a draft policy that addresses a range of concerns, is practical and applicable to a diverse sector.

Overview of the Data Protection and Use Policy

The Policy is being developed to address each of the topics identified during the engagement.

The scope of the policy is to:

  • Ensure those receiving social services have a better understanding about how their personal information is collected and used;
  • Clarify when personal identifiable information is needed and what types of personal information should be used for what purpose;
  • Build understanding of what protocols, structures and measures need to be in place to protect personal information;
  • Equip the social sector to work together using information to improve services and make better decisions for New Zealanders; 
  • Build understanding, trust, and confidence around the collection, storage and analysis of information.

What do we mean by a “policy”?

The Policy will be a combination of principles and guidelines. It will be supported by a ‘toolkit’ which will be developed over time, to support and enable the social sector to easily understand what‘s appropriate and how to safely work with personal information.

Further information about the Policy is included in the FAQs page.

Programme Timeline

Here are the key steps in the process to develop the Data Protection and Use Policy.

Early 2018  Design of the engagement process
May – Sep 2018  Engagement phase (Your voice, your data, your say)
Oct – Nov 2018  Collaborative policy design – sector representatives
 Nov 2018  Findings  published
Jan - Jun 2019 Refinement of draft Policy
Jul - Aug 2019 Targeted engagement – the Policy and implementation options
Sep Onwards Implementation planning
Late 2019 Data Protection and Use Policy presented to Cabinet*

 *Subject to confirmation


If you have any questions, please email us.


Export PDF